01 / Trust

The smallest possible access.

A data integrity platform that asks for broad credentials has already failed at its own premise. This page states what we ask for, what we hold, where it lives, and who to write to when something looks wrong.

02 / Posture

Four claims, each with a check.

Everything below is verifiable from your side — in your KMS, in your network logs, in the credentials you issued us. That is the point.

Credentials

Every connector asks for read-only access scoped to a prefix, a schema or a topic. Nothing is installed inside your database. If a connector needs write access to function, we treat that as a bug in the connector.

Access: Read-only
Scope: Prefix or schema
Agent: None installed

Encryption

AES-256-GCM at rest, TLS 1.3 in transit, with no downgrade path. Keys stay in your own KMS on Professional and Enterprise, so revoking our access is a change you make on your side and not a support ticket on ours.

At rest: AES-256-GCM
In transit: TLS 1.3
Key custody: Customer managed

Isolation

One tenant, one key, one logical store. Quarantined rows never leave the region they were ingested in. Self-hosted deployments run entirely inside your own network boundary, with no outbound call required to validate a row.

Tenancy: Logically isolated
Data residency: EU, US, or your VPC
Egress: None required

Access

Decryption passes through a broker, so there is one ordered access log in one clock and one format. Role changes, policy edits and every decrypt land in the same append-only ledger as validation results.

Log: Append only
Retention: Up to 7 years
Export: CSV, Parquet, JSON

03 / Compliance

Frameworks, and what they actually cover.

A badge without a scope is decoration. Each entry says what is in scope and what you have to ask for.

SOC 2 Type II

Security, availability and confidentiality criteria

Continuous evidence collection rather than an annual scramble. Report available under NDA.

GDPR

Lawful basis, retention and erasure, per field

A data processing agreement and the current subprocessor list are available on request.

HIPAA

PHI tagged at ingest, excluded from exports by default

Business associate agreement available on Professional and Enterprise.

FedRAMP

Moderate baseline, self-hosted deployment

Available on Enterprise. Ask before you plan around it.

Attestations are issued to the operator of this deployment. Ask sales@neuryn.com for the current reports and their dates.

04 / Availability

Targets we will put in a contract.

Numbers that mean something only if you know what they are measured on. So here is what they are measured on.

Uptime target: 99.98%; Measured on the validation path, not on the marketing site.
Recovery point: 5 minutes; Maximum data loss in a regional failover.
Recovery time: 30 minutes; Time to serve validation again from a second region.
Backup retention: 35 days; Point-in-time restore across the whole window.

05 / Disclosure

Found something? Write first.

We would rather hear about a flaw from you than read about it later. Report it to security@neuryn.com and encrypt with our PGP key if the report contains anything sensitive. The key fingerprint is published on the legal page.

01 Acknowledged in one business day A human replies, not an autoresponder.
02 Assessed in five business days You get our severity read and the reasoning behind it.
03 Fixed, then disclosed together We agree the timing with you. We do not ask for silence.

Good-faith research on your own tenant will not get you a legal letter from us.

06 / Procurement

What your reviewers can ask for.

Security review is the slowest part of most purchases. Everything on this list exists already, so nothing has to be written from scratch for you.

Security questionnaire: Send yours. We fill in the one you have rather than asking you to accept ours.
Penetration test: Latest third-party summary available under NDA.
Subprocessors: Current list on request, with 30 days notice before any addition.
Data processing agreement: Standard DPA with EU standard contractual clauses.
Architecture review: A working session with an engineer, not a slide deck.

Start a security review Data requests: privacy@neuryn.com