Your Clients Trust You.
You Can Trust Us.
For 15 years, advisors have put their clients' most sensitive financial data into Nitrogen. We protect it with independently audited controls, certified AI governance, and a simple rule: your data is never used to train AI models.
Defense in Depth, Across Every Product
Risk Center, Research Center, Income Center, Tax Center, Legacy Center, and Insurance Center all run on the same platform and inherit the same controls. New features, including our AI, don't get exceptions.
Encryption Everywhere
Client data is encrypted on the way in and while it sits on our servers.
- 256-bit SSL/TLS encryption for all data in transit
- 256-bit AES encryption at rest for sensitive data and documents
Tight Access Controls
People and systems see only what they're authorized to see.
- Role-based, tenant-scoped authorization prevents cross-firm data exposure
- Least-privilege internal access, audited through AWS IAM and SSO
- Code review and approval on every production change
Tested by Outsiders
We hire third parties to try to break in, then fix what they find.
- Regular third-party vulnerability assessments and penetration tests
- Secure development aligned to OWASP Top 10, SANS CWE Top 25 and CERT Secure Coding
Ready When It Matters
A documented incident response process, aligned to the SEC's Regulation S-P amendments.
- Centralized monitoring, escalation and containment
- Data impact assessment for every incident
- Support for your firm's Reg S-P customer notification obligations
- Root-cause analysis and control updates after the fact
AI Built for Regulated Advice
Nucleus and our other AI features exist to give advisors time back, not to make decisions for them. Nitrogen is certified under ISO/IEC 42001, so the way we build, test and monitor AI is independently verified, not just promised.
Your data is never used to train AI models. Not ours, not anyone else's.
That covers advisor prompts and chats, uploaded account statements, tax documents, and meeting recordings and transcripts. The commitment is in writing and binds every subprocessor we work with.
What our AI won't do
- Replace advisor judgmentAI assists. Advisors decide. Nothing acts autonomously on a client's behalf.
- Give directive adviceGuardrails are designed to keep AI from offering financial, tax or legal recommendations or market predictions.
- Talk to your clientsNucleus works with advisors only. It never interacts directly with end clients.
- Skip the review stepEvery AI output needs advisor review before client use, and changes to client records need advisor confirmation.
- Cross tenant boundariesAI sees only the data the signed-in advisor is already authorized to see.
Inside our perimeter
Nucleus runs models through Amazon Bedrock within Nitrogen's AWS environment. Prompts and client data aren't sent to outside AI vendors.
Deterministic deliverables
Client-facing output comes from the same compliance-approved reports and visuals firms already use. Same inputs, same results, every time.
Verifiable by design
AI features are clearly labeled, reference their source data, and sit next to the records advisors can check them against.
Built to Pass Your Home Office Review
Most wealth management firms require a formal review before approving new technology, and AI gets extra scrutiny. We've done this many times and we'll give your team what it needs.
Subprocessors Held to Our Standard
Some features use specialized, independently certified partners. Each one goes through the same process before it touches customer data.
- Vetted and approved by Nitrogen's GRC Committee through our vendor-risk management program
- SOC 2 or equivalent reports reviewed every year
- Data processing agreements covering data protection, confidentiality and breach notification
- Encrypted channels for every data exchange, and our Zero Training Commitment flowed down in writing
Everything Your Reviewers Will Ask For
Request access in the Trust Center. Some materials are shared under NDA.
- SOC 2 Type II reportSecurity and Confidentiality criteria
- AI Governance PolicyPrinciples, restrictions, access controls and incident response for AI
- Product security and compliance FAQsNucleus, Tax Center, AI Statement Capture and Insurance Center
- Help with your security questionnairePlus time with our team if your reviewers want to talk it through
Questions We Hear From Compliance
Don't see yours? Your Nitrogen account representative can connect you with our team.
Does Nitrogen use our data to train AI models?
No. Under our Zero Training Commitment, customer data is never used to train or improve any AI model, internal or third-party. That includes prompts, chat history, uploaded statements, tax documents and meeting recordings or transcripts. The commitment is in writing and binds our subprocessors.
What does your SOC 2 report cover?
Nitrogen maintains an SSAE 18 SOC 2 Type II report for the Security and Confidentiality trust services criteria. An independent third party audits our systems, processes and controls every year, including the controls that govern our AI features. Request the report through the Trust Center.
What is ISO/IEC 42001, and why does it matter?
ISO/IEC 42001 is the international standard for AI management systems. Our certification means an independent auditor has verified that we maintain documented AI governance policies, risk and impact assessments, controls over how data flows through AI processing, model selection and evaluation, human oversight, and AI-specific incident response.
For your review, it's independent evidence that our AI is governed, not just described in a policy document.
Where is our data stored?
In SOC 2 Type II and ISO 27001 certified data centers in the United States, within Nitrogen's AWS environment. Data is encrypted in transit with 256-bit SSL/TLS and sensitive data is encrypted at rest with 256-bit AES.
Does client data ever leave Nitrogen's environment?
Nucleus and AI Statement Capture process data inside our AWS perimeter using Amazon Bedrock, with no transfer to outside AI vendors. A few specialized features, such as tax document processing and meeting capture, use independently certified subprocessors. Those partners are vetted by our GRC Committee, reviewed annually and bound by data processing agreements. Feature-specific data flows are documented in our product FAQs, available through the Trust Center.
Can we approve AI features under our firm's AI policy?
That's what our documentation is for. Our AI Governance Policy, product FAQs and ISO/IEC 42001 certification are built to support home office AI reviews, and we're happy to meet with your compliance team. Many firms find that approving a governed tool reduces risk compared with advisors pasting client data into general-purpose chatbots on their own.
How do you handle a security incident?
Our incident response process is aligned with the SEC's amendments to Regulation S-P: rapid identification and containment, an assessment of whether customer information was affected, support for your notification obligations where customer information was likely accessed without authorization, and a post-incident review that updates our controls. AI incidents follow the same process, with no carve-outs.
How do I report a vulnerability?
Email security@nitrogenwealth.com. We welcome responsible disclosure and review every report.
See the Evidence for Yourself
Review our security posture and request our SOC 2 report and supporting documentation, all in one place.
Found a security issue? security@nitrogenwealth.com