Where your post-trade platform runs is a board decision, not a vendor constraint. NOVA CMX is cloud-agnostic by design: the same platform, the same release train, deployed as managed SaaS, in your private cloud, or entirely inside your own data centre. Underneath it sits an n-tier architecture with a dedicated security tier – so scale, control and jurisdiction stay yours to set.
99.99%
cloud uptime SLA on managed deployments
20–40%
lower total cost of ownership on cloud or managed services
12 weeks
recent Tier-1 go-lives, with 70% of functionality out of the box
0
proprietary tiers - every layer is built on industry-standard primitives, so there is no lock-in to unwind later
We run the infrastructure; you run the business. Rapid provisioning, predictable OPEX, no capacity planning and no hardware refresh cycle. Hosted on AWS or the provider you already use.
Dedicated infrastructure in the jurisdiction you nominate, with data residency and network controls under your governance. Cloud economics without shared tenancy.
Run the whole platform inside your data centre, or split it - sensitive data local, elastic workloads in cloud. Container-native, so the topology follows your policy rather than dictating it.
Angular · Bootstrap
No fat client to distribute
Java · C++ · multi-process
Configuration, not code
REST · FIX · SWIFT · ISO 20022 · MQ
Adapters at the edge
Oracle · Linux · DWH-ready
Read paths kept separate
Docker · Kubernetes · any cloud
Not the whole platform
Keycloak · Kerberos · IdP federation · CyberArk
Enforced across every tier
Federated to your IDP - your joiners, movers and leavers process governs platform access.
Encrypted at rest for data and backups, with keys held in your own key management where policy requires.
Segmented tiers - the presentation tier has no route to the data tier, so a web-facing compromise stops there.
Role-based entitlements down to function and field, with maker-checker on sensitive actions.
Keys stay on your side in private-cloud and on-premise deployments - we operate the platform, not your secrets.
Auditable by design, with a retained record of who changed what, in which tier and when.
Privileged access vaulted, so no standing administrative credentials sit in the platform.
Encrypted in transit across every tier boundary and every market interface.
SOC 2 Type 2 controls and standards-based interfaces your assurance team can test independently.
Federated to your IdP - your joiners, movers and leavers process governs platform access.
Role-based entitlements down to function and field, with maker-checker on sensitive actions.
Privileged access vaulted, so no standing administrative credentials sit in the platform.
Encrypted at rest for data and backups, with keys held in your own key management where policy requires.
Keys stay on your side in private-cloud and on-premise deployments - we operate the platform, not your secrets.
Encrypted in transit across every tier boundary and every market interface.
Segmented tiers - the presentation tier has no route to the data tier, so a web-facing compromise stops there.
Auditable by design, with a retained record of who changed what, in which tier and when.
SOC 2 Type 2 controls and standards-based interfaces your assurance team can test independently.
01
Standard primitives at every tier. Your next platform decision stays a choice.
02
Scale the tier under load instead of over-provisioning the whole estate for peak volume.
03
Residency, sovereignty and outsourcing questions are answered by where it runs, not by exception.
04
Business rules live in configuration, so operations move at market speed and IT keeps control.
05
Tier separation and a dedicated security layer contain incidents instead of propagating them.