--- title: "Security at NebuSec" description: "Learn how NebuSec protects customer data and systems through technical, personnel, vendor, continuity, and incident-response controls." url: https://nebusec.ai/security/ --- # Security is built into how we operate. NebuSec helps teams find vulnerabilities before attackers do. We apply the same discipline to the systems and data entrusted to us. [Contact NebuSec](mailto:root@nebusec.ai?subject=NebuSec%20security%20review)[Privacy Policy](https://nebusec.ai/privacy/) Program ownerNebuSec Corp. ยท SecurityLast reviewedSeptember 7, 2026 ## Controls begin with clear principles. 1. ### Least privilege Access is limited to people and systems with a legitimate need, for no longer than that need exists. 2. ### Defense in depth We layer preventive, detective, and responsive controls so that no single safeguard carries the entire burden. 3. ### Continuous improvement Controls are reviewed as our products, infrastructure, risks, and customer requirements change. ## How we protect customer data and systems The controls below describe our current public posture. Their implementation may vary by product, deployment model, and customer agreement. ### Data protection Customer data is handled according to its sensitivity and the service that processes it. * In transit NebuSec requires encrypted connections for customer data transmitted across public networks. * At rest Systems that persist customer data use encryption controls appropriate to the storage service and data type. * Data lifecycle We limit collection and retention to operational, contractual, and legal needs, as described in our Privacy Policy.[Read the Privacy Policy](https://nebusec.ai/privacy/) ### Infrastructure security Managed infrastructure and explicit environment boundaries reduce the systems our team must operate directly. * Service boundaries Production services, preview environments, and development workflows are separated according to their purpose. * Configuration Infrastructure and deployment changes are versioned, reviewed, and validated before release where the platform supports it. * Monitoring Availability checks and operational alerts help the team identify and investigate service disruption. Customers can review service availability and incident updates on the NebuSec status page.[View service status](https://status.nebusec.ai/) ### Access control Access to customer information and production systems is restricted to authorized personnel with a business need. * Authorization Access is scoped to the service and task rather than granted as broad, standing access. * Customer reports Private customer security reports are protected by report-specific access policies at the network edge. * Review Access requirements are revisited when responsibilities, systems, or customer engagements change. ### Secure development NebuSec applies its vulnerability-research experience throughout development and release work. * Change control Source changes are tracked in version control and reviewed before they are promoted to production. * Automated validation The public website build blocks high- or critical-severity dependency advisories and validates routes, links, accessibility, and page weight. * Research-led testing Our team validates security findings through technical analysis and, where appropriate, working reproduction or exploit evidence. ### Personnel and endpoint security Personnel and device controls reduce the risk of unauthorized access to company and customer systems. * Identity security Workforce access uses centralized identity controls, multi-factor authentication, and single sign-on where supported and appropriate. * Personnel security Security responsibilities are addressed during onboarding, with background screening applied where appropriate and permitted by law. * Awareness Personnel receive security guidance relevant to their responsibilities, including secure handling of systems, credentials, and customer information. * Endpoints Corporate endpoints use safeguards such as disk encryption, screen locking, software updates, and endpoint protection appropriate to the device and role. ### Vendor and subprocessor management Third parties are evaluated according to the access and risk introduced by the service they provide. * Due diligence Reviews consider the data a vendor handles, its access to company or production systems, and the operational importance of the service. * Safeguards Security, confidentiality, and data-protection obligations are included in vendor arrangements where appropriate to the relationship. * Subprocessors Information about subprocessors relevant to a customer service is maintained and can be provided during security review. ### Incident response Security and availability events are handled through a defined path from initial signal to follow-up. * Triage We assess the affected systems, data, customers, and immediate containment options. * Containment and recovery The team prioritizes limiting exposure, restoring safe operation, and preserving the evidence needed to understand the event. * Communication Affected customers receive relevant updates in accordance with contractual and legal obligations. ### Assurance and compliance Security claims should be current, specific, and capable of being verified during customer review. * Certifications SOC 2 readiness work is underway. NebuSec does not currently claim a completed SOC 2 report, attestation, or any other third-party compliance certification. Completed certifications will be named only after they can be independently verified. * Customer review Our team can discuss relevant controls, data handling, architecture, and security requirements during procurement. ## Continue the review with our team. Contact NebuSec to discuss a security questionnaire, architecture, data handling, or requirements specific to your organization. [Contact NebuSec](mailto:root@nebusec.ai?subject=NebuSec%20security%20review) **Keeping this page current.** The Security function at NebuSec Corp. owns the accuracy of these claims. The page is reviewed at least quarterly and after material changes to controls, infrastructure, assessments, or policy. Marketing may update presentation, but security claims require Security approval.