Security Policy
Last updated: November 29, 2025
SOC2 Type II
ISO 27001
HIPAA Compliant
Our Commitment to Security
At NebrasApps.com, security is not just a feature—it's the foundation of everything we do. As a company that helps others achieve compliance, we hold ourselves to the highest security standards.
Infrastructure Security
Cloud Infrastructure
- Hosted on DigitalOcean with SOC2 certified data centers
- Multi-region redundancy for high availability
- Automated scaling and load balancing
- DDoS protection at network edge
Network Security
- Virtual Private Cloud (VPC) isolation
- Network segmentation and micro-segmentation
- Intrusion detection and prevention systems
- Web Application Firewall (WAF) protection
Data Encryption
Encryption at Rest
- AES-256 encryption for all stored data
- Encrypted database backups
- Hardware Security Modules (HSM) for key management
Encryption in Transit
- TLS 1.3 for all connections
- Perfect Forward Secrecy (PFS) enabled
- Certificate pinning for mobile applications
- HSTS preloading enabled
Access Control
- Zero-trust security model
- Multi-factor authentication (MFA) required
- Role-based access control (RBAC)
- Principle of least privilege enforced
- Regular access reviews and audits
- Session timeout and automatic logout
Application Security
- Secure software development lifecycle (SSDLC)
- Regular code reviews and static analysis
- Dependency vulnerability scanning
- Regular penetration testing by third parties
- Bug bounty program for responsible disclosure
- Automated security testing in CI/CD pipeline
Monitoring and Incident Response
- 24/7 security operations center (SOC)
- Real-time threat detection and alerting
- Comprehensive logging and audit trails
- Incident response plan with defined SLAs
- Regular disaster recovery drills
- Automated threat hunting capabilities
Employee Security
- Background checks for all employees
- Mandatory security awareness training
- Clean desk and clear screen policies
- Secure remote work policies
- Annual security certifications
Vulnerability Disclosure
We value the security research community. If you discover a security vulnerability, please report it responsibly:
Email: [email protected]
PGP Key: Available upon request
Bug Bounty: We offer rewards for qualifying vulnerabilities
Compliance Certifications
We maintain the following certifications and attestations:
- SOC2 Type II (annually audited)
- ISO 27001:2022
- HIPAA Business Associate Agreement available
- GDPR compliant
- PCI DSS Level 1 Service Provider