NIN Genie Security Policy

Nveda Fintech Private Limited — Security for NINX Agentic Assistant & Connectors
Last Updated: February 2025

1. Introduction

NIN Genie is an agentic assistant that orchestrates actions across services you already use. Because NIN Genie can access financial, communication, and productivity systems through user approved connectors, security is foundational to the product.
This Security Policy provides a high level overview of how we protect NIN Genie workflows, with an emphasis on encryption, connector isolation, and continuous risk controls. It should be read together with the NIN Genie Privacy Policy.

2. Reporting Security Issues

We welcome responsible disclosures from security researchers, partners, and users. If you believe you have discovered a vulnerability, weakness, or other security issue related to NIN Genie or its connectors, please notify us as soon as possible.
When reporting, please share (without including sensitive credentials or live secrets):

  • A clear description of the issue and its potential impact.
  • Steps to reproduce the behavior, including example payloads where relevant.
  • Any logs, screenshots, or proof of concept material that helps us validate.
  • Your contact details so we can follow up for clarification.
    Security issues for NIN Genie can be reported to: security@nin.in
    We aim to acknowledge good faith reports promptly, investigate with appropriate urgency, and coordinate remediation. Where appropriate and lawful, we may also acknowledge contributors who prefer to be credited for responsible disclosures.

3. Core Security Principles

  • Defense in depth: Multiple security layers from browser to storage.
  • User isolation: Each user's sensitive data is protected with user specific encryption keys.
  • Minimal data surface: Encrypt everything sensitive and avoid collecting more than is needed to orchestrate workflows.
  • Non custodial orchestration: NIN Genie does not hold custody of funds; regulated entities remain the custodians.

4. Encryption and Key Management

NIN Genie uses an encryption service to protect connector credentials such as API keys, secrets, and access tokens:

  • AES 256 based encryption for sensitive connector data at rest.
  • Keys are derived per user (for example, using PBKDF2 with a user specific salt) and are not stored as plain values in the database.
  • Encryption and decryption are performed in application logic when credentials are saved or used, minimizing the time credentials spend in decrypted form.
  • Migration flows detect unencrypted legacy values and encrypt them on save, with safeguards and logging.
    If a storage system were compromised, encrypted connector data would remain unreadable without user derived keys.

5. Data Protection in Transit and at Rest

  • HTTPS and modern TLS are used for data in transit wherever applicable.
  • Sensitive connector fields (such as API secrets and access tokens) are encrypted at rest in databases and backups.
  • Access to production infrastructure is restricted, audited, and subject to principles of least privilege.
  • Security relevant events are logged to support investigation and forensics.

6. Application and Connector Security

  • Connectors for brokers, payment providers, and other services are implemented using a consistent repository pattern that encrypts on save and decrypts on load.
  • NIN Genie actions are logged and can be surfaced as human readable receipts so that users understand what the assistant did on their behalf.
  • Risk controls (such as limits, whitelists, and velocity checks) are designed to reduce the impact of misuse or misconfiguration.
  • Agentic flows are designed to prefer explicit confirmation for sensitive or high value operations.

7. Infrastructure and Monitoring

  • Regular updates and patches are applied to core infrastructure components.
  • Monitoring is in place to detect anomalies, excessive failures, or other patterns that may indicate abuse or incidents.
  • Access to logs and operational data is limited to authorized personnel and is used for maintenance, debugging, and security review.
  • Backups are encrypted and procedures are periodically reviewed for resilience and recovery.

8. User Responsibilities

Security is a shared responsibility. To help keep your NIN Genie experience safe:

  • Use strong authentication for your NINX account and connected services.
  • Do not share your login credentials or one time passwords with others.
  • Review connector access regularly and revoke any connectors you no longer need or trust.
  • Carefully review assistant summaries and receipts for high value actions before approving them.
  • Report suspicious activity or potential security concerns to security@nin.in as soon as possible.

9. Updates to This Security Policy

As NIN Genie evolves and as threats change, we may update this Security Policy. When we do, we will revise the "Last Updated" date at the top of this page. Significant changes may be communicated through additional in product notices or documentation.
If you have questions about this Security Policy or any aspect of NIN Genie security, you can contact our security and compliance team at security@nin.in.