Security architecture
Zero Public Attack Surface. Institutional Hardening.
Our APIs are only reachable through authenticated, encrypted WireGuard tunnels, on infrastructure that is locked down by design.
Infrastructure security
Hardened to institutional standards
Four controls that protect your data from the moment it reaches Noctula.
Advanced Device Fingerprinting
Recognises the device behind every session and catches spoofed devices and emulators.
JIT Masking & PII Protection
Customer data is masked by default. Seeing the real values needs a time-limited request that a person approves.
WireGuard Private Tunnels
The APIs can only be reached through authenticated private tunnels. Nothing is exposed to the public internet.
Hardened Host & Runtime Isolation
Systems are locked down from the start rather than watched for attacks: containers that cannot be changed while running, and each part gets only the access it needs.
Inherent Hardening, Not Reactive Monitoring
Security is built into how the system is wired, not bolted on afterwards.
API-First Cryptographic Isolation
The systems that receive and score your payments run inside their own isolated network. All traffic is encrypted with WireGuard and TLS 1.3.
Cryptographically Immutable Audit Trail
Every alert decision, rule change and approval is chained with SHA-256, so any later edit would show. Inspectors can verify it independently.