Security and trust
How NAVdryx isolates tenants, controls access, keeps an immutable audit trail, encrypts sensitive data, and constrains what AI is allowed to do.
Overview
NAVdryx holds capital account records, wire instructions, tax identifiers, and governing documents for private funds and their investors. The platform is designed around a small set of non-negotiable principles rather than security added after the fact: every tenant’s data is isolated by policy, every permission is deny-by-default, every governed record is amended by reversal instead of edited in place, and anything that touches money is calculated deterministically and approved by a person before it is treated as final.
Tenant isolation
Every tenant’s records carry an organization identifier, and access to them is enforced by policy at the database layer — not only in application code that a bug could bypass. A row-level security policy denies access by default; a query has to be explicitly authorized for the requesting tenant to return anything at all. This is verified continuously by an automated isolation test suite that proves one organization cannot read, write, or enumerate another organization’s records through any code path, and it runs on every change to the platform, not just before a release.
Access control
Permissions are defined in a single matrix of role, object, and action, and the default for anything not explicitly listed is deny. Roles span both sides of the platform — platform admin, organization admin, fund manager, fund accountant, fund controller, relationship owner, outside auditor, outside tax advisor, outside legal counsel, third-party fund administrator, LP, LP authorized signatory, LP finance contact, LPAC member, and portfolio company user — and each is scoped to what that role actually needs. Some permissions are immutable: posting to a closed accounting period without controller approval, for instance, cannot be granted even by a platform administrator. An LP’s access is scoped the same way as every other tenant boundary — enforced where the data is read, not only in what the interface displays — so an LP can never see another investor’s records regardless of what a misconfigured screen might otherwise show.
Audit trail
Every record creation, update, deletion, login, permission change, file access, file download, and export is logged with the acting user, a timestamp, an IP address, and the prior and new values where applicable. The log is append-only in practice — write once, never modified through any normal interface, including by a tenant administrator or by NAVdryx’s own staff. Governed financial records follow the same discipline at the record level: a capital event or a calculation is never edited in place once issued. A correction is a new, linked reversing entry, so the full history — including what was later found to be wrong — stays intact and reconstructable.
Encryption
Data is encrypted in transit using TLS. Sensitive fields — wire and bank details, tax identifiers, and third-party access tokens — are encrypted at the field level using AES-256-GCM, masked by default in the interface, and never included in logs, exports, or any AI request. Any change to a bank account requires dual control from two separate people, callback verification, and a recorded change history, routed through its own approval chain before it takes effect.
Authentication and sessions
Multi-factor authentication is enforced by default for every GP-side user, with an authenticator app and passkey/WebAuthn supported and SMS available only as an explicit fallback. Login attempts are throttled and lockouts apply from day one — this was never treated as a later-phase hardening step. Sessions carry an idle timeout and an absolute timeout, and a user can see their active devices and revoke any session directly.
Calculation integrity
Anything that touches money — capital account rollforwards, management fees, expense allocations, performance metrics — runs through a deterministic calculation engine, never a floating-point shortcut. Every run stores a frozen snapshot of its inputs, a version, and the identities of its preparer, reviewer, and approver, so a number can always be reproduced and traced back to exactly what produced it. Amendments are reversal-based, matching the audit-trail discipline above, and outputs stay in draft until a person approves them — nothing calculated is treated as final without a human in the loop.
How AI is used
AI in NAVdryx drafts and extracts; it never calculates and never finalizes anything. Document extraction and drafting assistants produce output with source citations back to the specific record, page, or clause they came from, and every output requires human review before it is relied on. Sensitive identifiers — tax IDs, bank details, personal identifiers — are stripped by a redaction step before any request reaches an AI provider, and every prompt and output is version-controlled and logged.
Vendors and manual fallback
External services — e-signature, email, identity, and similar providers — sit behind an internal adapter interface rather than being wired directly into the product, which keeps any single vendor from becoming a structural dependency. In the same spirit, every integration ships with a manual CSV, Excel, or PDF path. That path is not a fallback bolted on for outages; it is a designed feature, because a fund accountant must always be able to finish the job even when a specific integration is unavailable.
Independent testing
The platform is independently penetration tested before it is trusted with financial data, and again before the first client goes live on it. NAVdryx maintains a SOC 2 Type I readiness program as part of its standing security posture, with a defined path toward a Type II report over time. Data-retention floors are documented per record type and jurisdiction — covering securities, tax, anti-money-laundering, and privacy requirements — and are enforced as minimums that a tenant can extend but never shorten.