Security questionnaire

Short answers for a vendor-risk or CIO review. Full narrative is on the security page and how we use AI.

Where is data hosted?: DigitalOcean App Platform and managed PostgreSQL, NYC region, United States.
Encryption in transit?: TLS 1.3. Database connections use SSL.
Encryption at rest?: AES-256 (NIST Advanced Encryption Standard) on DigitalOcean managed volumes and PostgreSQL.
How are payments processed?: Stripe Checkout and Billing. Stripe is PCI DSS Level 1. Nuronus does not store PAN, CVV, or full card numbers — only Stripe customer and subscription IDs.
What PII do you store?: Names, emails, and company/client records you enter, plus audit logs. Encrypted at rest with AES-256 and in transit with TLS 1.3. We do not sell PII or use it to contact your clients. Payment card data is not stored in Nuronus.
Multi-tenant isolation?: Yes. Application middleware scopes every authenticated request to the MSP (and client). Cross-tenant access is denied. Database RLS is implemented and staged for production as defense in depth.
Do you sell or share customer data?: No. We do not sell MSP or client compliance data. We do not contact your clients.
Subprocessors?: DigitalOcean (hosting/DB), Anthropic (optional Copilot only), Resend (email), Stripe (billing).
Is customer data used to train models?: Nuronus does not train models on customer data. Optional Copilot sends question + assessment context to Anthropic’s API to draft text.
Can AI be turned off?: Yes. Do not use Copilot. Scoring, mappings, evidence, and reports still function.
Integrations write to client tenants?: No. Read-only / least-privilege. No agent on endpoints.
Backups?: DigitalOcean managed database automated backups. Restore is operator-controlled.
SSO?: SAML/SSO available for MSP users.
Audit logging?: Platform actions (login, data access, report generation, config changes) are logged and exportable.
SOC 2 / ISO 27001?: Nuronus SOC 2 Type II is in progress, not complete. Infrastructure provider (DigitalOcean) is SOC 2 Type II certified.
Penetration test?: First independent pentest target: October 2026. Results under NDA after the engagement.
Data export / deletion?: Export PDF/CSV anytime. Deletion or anonymization of personal data within 30 days of account deletion, except legal hold.
Who to contact?: [email protected]