Trust
Security at Nuronus
We sell compliance software, so MSPs and their CIOs ask us the same questions their clients ask them. This page is the short answer: what we store, where it lives, how it is isolated, and what is certified versus in progress.
Nuronus is not SOC 2 or ISO 27001 certified today. Our Type II program is in progress. The platform runs on DigitalOcean managed infrastructure that is SOC 2 Type II certified. First independent penetration test target: October 2026.
Data flow
- 1
MSP connects a client
Read-only OAuth or API credentials for Microsoft 365, Google Workspace, RMM, or cloud. We never write, modify, or delete anything in the client environment. No agent is installed on endpoints.
- 2
Snapshots land in Nuronus
We store account data you enter, client records, read-only inventory/posture snapshots, control check results, evidence references, generated reports, and audit logs. Hosted on DigitalOcean in the United States (NYC region).
- 3
Access is scoped per tenant
Every authenticated API request is bound to the MSP (and client, when applicable). Application middleware blocks cross-tenant reads. Credentials are never shared across MSPs or across clients inside an MSP.
- 4
You export or delete
Export reports, gap lists, and client records (PDF/CSV) at any time. On account deletion we delete or anonymize personal data within 30 days, except where law requires a hold.
How data is protected
Encryption
Data in our databases and volumes is encrypted at rest with AES-256 (the NIST Advanced Encryption Standard). Connections use TLS 1.3 in transit, including PostgreSQL over SSL. No exceptions for traffic between our services.
Payments
Subscription billing is processed by Stripe. Stripe is a PCI DSS Level 1 certified payment provider. Card numbers, CVV, and other payment card data never enter the Nuronus application or our databases — checkout and card storage stay on Stripe. We keep only Stripe customer and subscription identifiers needed to manage the plan.
Personal information (PII)
We store the personal data required to run the product: names, emails, and company or client records you enter, plus audit logs of account activity. We do not sell PII, and we do not use it to contact your clients. That data lives in PostgreSQL, encrypted at rest with AES-256 and in transit with TLS 1.3. You can export it or request deletion as described above.
Tenant isolation
Isolation is enforced in application middleware on every authenticated request (MSP and client scope). Cross-tenant reads return 403. Database row-level security is implemented and staged for production enablement as defense in depth — it is not the only control.
Access control
JWT access tokens (15 minutes) plus refresh tokens. Roles: MSP admin, MSP technician, client viewer. SSO/SAML available. Production access is limited to the founder/operator; customer data is not used for marketing outreach to your clients.
What we do not do
We do not sell MSP or client data. We do not contact your clients. White-label reports and the client portal carry your brand. Integrations are least-privilege and read-only.
Subprocessors
Vendors that may process customer data to run the product.
| Vendor | Purpose | Region |
|---|---|---|
| DigitalOcean | Application hosting, managed PostgreSQL, backups | United States |
| Anthropic | Optional Copilot / risk-narrative drafts only. Not used to score controls. | United States |
| Resend | Transactional email (invites, password reset, reports you send) | United States |
| Stripe | Billing and payment processing (PCI DSS Level 1). No card data stored in Nuronus. | United States |
Testing and assurance
- Frontend changes are gated on TypeScript, ESLint, and a production Next.js build before they ship.
- API tests run with Vitest against PostgreSQL. End-to-end tests cover login and core dashboard paths.
- Auth, tenant scoping, and integration providers have automated tests (including Tactical RMM).
- Independent penetration test target: October 2026. Results available to customers under NDA after that engagement.
- SOC 2 Type II: in progress. Ask for the current control list and timeline at [email protected].
Responsible disclosure
If you believe you have found a security vulnerability in Nuronus (the web app, API, or related infrastructure), email [email protected]. Please include steps to reproduce, affected URLs or endpoints, and impact. Do not access or modify other customers' data, and do not perform denial-of-service testing.
We aim to acknowledge reports within a few business days and will work with you on a fix before any public disclosure. Machine-readable contact details are published at /.well-known/security.txt.
Documents
Privacy policy and terms are public. For a CIO review, send the questionnaire answers, this page, and how we use AI— then they can start free when trust is high. Sample reports are labeled demo data; scores come from mapped controls, not from a language model.