12-domain security architecture built for embargoed IP and financial ledgers.
Publishing houses entrust British Noble with pre-release manuscripts, author tax records, and global royalty disbursements. Every layer is built for CISO and procurement scrutiny.
Twelve enterprise security and governance domains
Encryption in Transit & at Rest
TLS 1.3 on all edges and AES-256-GCM storage encryption with automated annual key rotation.
Granular Imprint & Title RBAC
Least-privilege access scoped by group, imprint, department role, and embargoed Title ID.
Mandatory MFA & Payee Locks
WebAuthn and TOTP multi-factor enforcement across staff and step-up MFA for bank coordinate edits.
SAML 2.0 SSO & SCIM 2.0
Federated sign-in and instant de-provisioning via Okta, Microsoft Entra ID, and Google Workspace.
Immutable Audit Logging
Tamper-evident logs for sign-ins, manuscript downloads, contract edits, ONIX pushes, and payouts.
Retention & Cryptographic Erasure
Configurable submission purge rules and certified cryptographic key destruction at contract exit.
Backup & DR (15m RPO / 2h RTO)
Multi-AZ synchronous replication, immutable daily backups, and bi-annual failover verification.
Strict Tenant KMS Isolation
Dedicated per-tenant KMS envelope keys and row-level security preventing cross-tenant access.
Regional Cloud Data Residency
Pin manuscripts, assets, and PII to UK, EU, US, or UAE vaults under GDPR, UK IDTA, and UAE PDPL.
BISG Zero-Training AI Policy
Zero customer manuscripts, edits, or sales records are ever retained by or used to train AI models.
24-Hour Incident Response SLA
Continuous security monitoring with contractual 24-hour controller incident notification.
SOC 2, ISO 27001 & CREST
Aligned controls, annual CREST penetration testing, CSA CAIQ pack, and sub-processor governance.
Q4 2026 CREST-accredited penetration test executive summary
Conducted 14–25 October 2026 against OWASP ASVS v4.0.3 Level 2 and OSSTMM standards across authenticated web workspaces, REST APIs, and multi-tenant vaults.
Grey-Box Application, API & Tenant Isolation Audit
- Engagement Window: 14 October – 25 October 2026 (Remediation re-test verified 04 November 2026).
- In-Scope Targets: 11-screen authenticated
/app/workspace, REST/api/*endpoints, SAML/HMAC session cookies, PDF/IDML/EPUB preflight worker sandboxes, and cross-tenant KMS/database row isolation. - Assessor Qualification: Independent UK CREST-registered penetration testing practice (CHECK Team Leader certified).
Finding Severity Distribution (v2026.11 Release)
| Severity | Identified | Status | Verification Date |
|---|---|---|---|
| Critical | 0 | NONE FOUND | 25 Oct 2026 |
| High | 0 | NONE FOUND | 25 Oct 2026 |
| Medium | 2 | 2/2 REMEDIATED | 04 Nov 2026 |
| Low / Info | 3 | 3/3 HARDENED | 04 Nov 2026 |
Four regional KMS cloud vaults aligned to publishing statutes
| Cloud Region | Primary Zone | Statutory & Transfer Alignment | Key Management |
|---|---|---|---|
| United Kingdom | London (eu-west-2) | UK GDPR, Data Protection Act 2018 & UK ICO IDTA | Tenant Envelope KMS + BYOK |
| European Union | Frankfurt (eu-central-1) | EU GDPR, EU SCCs (Module 2) & ISO 27018 | Tenant Envelope KMS + BYOK |
| United States | N. Virginia (us-east-1) | SOC 2 Type II, CCPA/CPRA & IRS W-9/W-8 Vault | Tenant Envelope KMS + BYOK |
| United Arab Emirates | UAE Central (me-central-1) | UAE Federal Decree-Law No. 45/2021 (PDPL) & DIFC DP Law | Tenant Envelope KMS + BYOK |
Every manuscript, proof, and contract is encrypted at rest with AES-256-GCM under tenant-isolated AWS KMS keys and transmitted exclusively over TLS 1.3.
Never. Tenant data is contractually and technically isolated from foundation model training, fine-tuning, or cross-tenant retrieval under our Responsible AI Charter.
Workspaces pin primary storage, backups, and AI inference processing to UK (London), EU (Frankfurt), US (Virginia), or UAE (Dubai) cloud regions.
Enterprise and Mid-Market editions support SAML 2.0 and OIDC federation with Okta, Microsoft Entra ID, and Google Workspace alongside SCIM 2.0 lifecycle provisioning.
Administrators scope permissions by division, imprint, capability module, and individual Title ID so external freelancers never view unauthorised manuscripts or advances.
Yes. Every sign-in, permission change, manuscript download, ONIX dispatch, and payee bank edit writes to an append-only audit log exportable to Splunk, Datadog, or Microsoft Sentinel.
Synchronous database replication across three availability zones provides a 15-minute Recovery Point Objective (RPO) and a 2-hour Recovery Time Objective (RTO).
Our Information Security Policy and Data Processing Addendum commit to notifying affected Data Controllers within 24 hours of confirming any unauthorised access.
Our Q4 2026 grey-box web, API, and multi-tenant isolation penetration test ran 14–25 October 2026 with 0 Critical and 0 High findings, and 2/2 Medium findings remediated and re-verified on 04 November 2026.
Download our 2026 Security Architecture Whitepaper directly on this page or email Security@BritishNoble.com to request our full Enterprise Assurance Pack under mutual NDA.
Schedule a joint CISO, DPO, and solutions architecture review.
Walk through tenant KMS isolation, SAML 2.0 federation, zero-training AI controls, and regional data residency with our security engineers.