SECURITY

Boring where it matters.

Security here is the dull, load-bearing kind: encrypted connections, sealed keys, separated systems and a record of everything that ran. No badge wall, no acronyms we cannot back — we would rather describe exactly what we do.

tls in transit · sealed at rest · prepaid · audited

THE POSTURE

Six dull facts.

Nothing on this list is novel — that is the point. These are the defaults the whole fleet is built on, and they hold for every app that boards.

TLS everywhere

Every connection runs over TLS — browser to console, client to API, service to service. There is no plaintext hop to find.

Secrets sealed at rest

Provider keys and customer API-key secrets are encrypted before they reach the database and stay encrypted at rest. Plaintext never sits on disk.

An isolated hot path

Inference runs on dedicated gateway nodes that do nothing else. They reach the rest of the system only over a private network — never the open internet.

Separate planes

Identity, billing and admin are separate services with separate jobs. The sign-in system knows who you are and nothing about your balance; none holds more than its job needs.

Prepaid, by design

Your account holds a balance, not a card on file. Spend stops where the balance stops — the worst case is always a number you chose in advance.

Everything on the record

Every request is logged with its route, outcome and cost, and operator actions land in an audit log of their own. When you ask what happened, there is an answer.

THE HOT PATH

How a request travels.

Four stops, the same every time. Your request is encrypted before it leaves, handled by a machine that does nothing else, and forwarded with a key scoped to that one job.

route · your app → api.n4n.ai → provider

01 Clientyour code calls the endpoint · api key in the header
02 TLSencrypted before it leaves · nothing readable on the wire
03 Gateway nodededicated, isolated machine · private network inward
04 Providercalled with a scoped key · the answer returns the same route

one route·every request logged with its outcome·same rules for everyone — nothing bespoke, nothing exempt

REPORT

Found something? Tell us first.

If you think you have found a vulnerability, write tosupport@n4n.iowith Security in the subject. It lands in front of the people who can fix it, and a person answers.