Trust & Security
Trust Center
Security controls, AI governance, and Singapore alignment for subscribers evaluating Numeraxia.
Company
Numeraxia Technologies Pte. Ltd.
UEN: 202628793G
60 Paya Lebar Road, #06-28 Paya Lebar Square, Singapore 409051.
Infrastructure
- Database: Supabase Postgres (ap-southeast-1)
- Frontend: Vercel (global edge)
- API: Render or AWS ECS
- DNS: Cloudflare
Compliance roadmap
Singapore AI governance alignment
Voluntary alignment with PDPA, IMDA Model AI Governance Frameworks, and AI Verify testing — not a government certification.
PDPA
In progressPrivacy Policy, DPA template, data export APIs
Gen AI MGF 2024
In progressInput guards, output validation, AI disclosure
Agentic AI MGF 2026
In progressCapability bounding, HITL gates, audit logging
AI Verify
In progressSelf-assessment testing — report on Trust Center
Security
Controls in production
| Area | Control | Status |
|---|---|---|
| Authentication | JWT Bearer + RBAC (viewer → admin) | Active |
| Platform admin | Separate platform JWT from server secret | Active |
| Encryption | Fernet for integration credentials (enc:v1:) | Active |
| Database | Supabase Postgres RLS lockdown on Data API | Active |
| Audit | Append-only audit_logs for admin actions | Active |
| Webhooks | Stripe + WhatsApp signature verification | Active |
| Rate limiting | Login + public chat/lead endpoints | Active |
| AI input guard | Prompt-injection blocking on public chat | Active |
| Production guard | Fail-fast on weak secrets in production | Active |
| Headers | X-Frame-Options, nosniff, Referrer-Policy (Vercel) | Active |
AI governance
How we govern AI
Numeraxia is an agentic AI platform. We bound capabilities by subscription, apply input/output guardrails, and log high-impact actions.
Primary model: OpenAI gpt-4o-mini (optional — rule-based fallback when unconfigured). Receptionist answers only from subscriber business context; server-side validation blocks common prompt injection.
Full AI disclosure in Privacy Policy →Subprocessors
Third-party services
| Provider | Purpose | Region |
|---|---|---|
| Supabase | Managed PostgreSQL | ap-southeast-1 |
| OpenAI | LLM inference & TTS | United States |
| Stripe | Billing & subscriptions | United States |
| Resend | Transactional email | United States |
| Meta | WhatsApp Cloud API (optional) | Global |
| Telegram | Bot API (optional) | Global |
| Vercel | Frontend hosting | Global edge |
| Render / AWS | API hosting | Configurable |
| Sentry | Error monitoring (optional) | United States |
AI Verify
Testing & assurance
Last tested: July 2026
Toolkit: AI Verify Starter Kit (LLM Safety)
Use cases: Smart Website receptionist, Lead scoring, WhatsApp intent extraction
Status: Self-assessment complete — see docs/governance/ai-verify-report.md
Full report: repository path docs/governance/ai-verify-report.md
Contact
Security enquiries
Report a vulnerability or request enterprise documentation (DPA, security questionnaire).
Numeraxia Technologies Pte. Ltd. · UEN 202628793G