Information Security Policy

This Information Security Policy describes the technical and organisational measures NEBULONS AI applies to protect Customer Data and the NEBULONS AI Studio platform. It is incorporated into the Master Services Agreement and the Data Processing Agreement, and is reviewed at least annually by NEBULONS AI's security function.

NEBULONS AI operates an information security programme aligned with recognised frameworks, including the ISO/IEC 27001 control structure and the NIST Cybersecurity Framework. The programme is built around the principle of least privilege: access to production systems and Customer Data is restricted to the minimum number of named personnel strictly required to operate, support, and secure the Services, and every access to Customer Data is audit-logged and attributable to an identified individual.

All Customer Data is encrypted in transit using TLS 1.3 or stronger protocols, and at rest using AES-256 or stronger encryption with managed key rotation. Encryption keys are stored separately from encrypted data, and key access is restricted to automated systems rather than individuals. Model artifacts the Customer chooses to persist are stored in the Customer's isolated, encrypted environment and are never co-mingled with other customers' storage.

The platform runs on hardened, network-segmented infrastructure. Production environments are logically isolated from corporate systems and from other customers' environments; administrative access is possible only through secured, multi-factor-authenticated channels over a minimal footprint, with privileged sessions recorded. Network egress from customer processing environments is restricted by default to prevent unauthorised data flows.

Personnel undergo background screening appropriate to local law before joining and receive security and data protection training at onboarding and at least annually thereafter. All personnel are bound by written confidentiality obligations that survive employment. Offboarding procedures revoke all access immediately upon separation.

NEBULONS AI maintains continuous security monitoring, centralised logging, and automated alerting across infrastructure and application layers. Vulnerability management includes regular dependency scanning, automated patching, periodic internal and third-party penetration testing, and a defined remediation timeline for findings based on severity. Security logs are tamper-evident and retained strictly for the minimum period needed for security purposes, in line with the Data Retention and Deletion Policy.

Security incidents are handled under the Data Breach Incident Response Policy, with defined severity levels, escalation paths, and communication procedures. Disaster recovery and business continuity plans — including encrypted backup rotation and environment restoration procedures — are tested periodically, and are designed so that the zero-retention guarantees to Customers are preserved even during recovery events.

NEBULONS AI makes available to Customers, on request and subject to confidentiality, summaries of independent security attestations and this policy's control descriptions sufficient for the Customer's own compliance assessments. Customers are responsible for the security of their own accounts and endpoints, including credential hygiene and access control on their side of the connection.