An index of your code,
on infrastructure you own
Deterministic resolution across large, tangled, polyglot codebases — call chains and blast radius you can verify, not a model’s best guess.
Deployment shapes
No egress at all. For code that legally cannot leave the building, the graph is built and queried inside it.
| Source code | never leaves |
|---|---|
| The graph | your infrastructure |
| Model calls | through yours |
| Who holds the keys | you |
What a security
review will ask
Single sign-on
OAuth 2.0 against your identity provider, so access follows accounts you already manage and revocation is immediate.
Audit log
Who asked what, and when. Every query against the graph is attributable to an account.
Account isolation
Every project, index and session is keyed to an account. One tenant cannot traverse into another tenant’s graph.
Secrets stay secret
Config values are redacted before storage; environment payloads are encrypted in the indexing worker. The graph records that a value is wired, not what it is.
Source is not telemetry
Files move over multipart and are never written to logs. Indexing needs your code; observability does not.
Branch honesty
On a branch no project covers, Niro refuses rather than answering from stale code. A confidently wrong answer is the expensive kind.
Compliance
Data residency, retention windows and processing agreements are per deployment - ask, and we will answer for the shape you are considering.
What procurement
always asks
Where do model calls go in an air-gapped deployment?
Through your gateway, with your keys. Air-gapped means no egress: the graph is built and queried inside the boundary. In the managed shape those calls go through our gateway instead - which is the trade you are making when you pick it.
What does a self-hosted deployment need?
Java 17, MongoDB, Neo4j and Redis, wherever you run things. Nothing exotic, and nothing phoning home for permission to answer.
Which certifications do you hold today?
GDPR: compliant. ISO 27001: in progress. SOC 2 Type II: in progress. HIPAA, CCPA and SAML are not claimed.
Where is our data held, and for how long?
Data residency, retention windows and processing agreements are set per deployment shape. In the managed shape the graph sits in our infrastructure; in your own VPC, self-hosted or air-gapped it sits in yours, and you hold the keys, the logs and the backups. Ask for the shape you are considering and we will answer for that one.
Bring your
security questionnaire
Deployment shape, data residency, retention, procurement. Faster in a conversation than in a form.