Trust Centre
What we do, what we commit to, and what we do not yet claim.
Most trust pages are a wall of badges. This one describes mechanisms — the specific thing in the system that makes the statement true — and it is explicit about the gaps.
We hold no security certifications at this time. There is no ISO 27001 badge, no SOC 2 badge and no “certification in progress” label on this page, because those claims are frequently used to imply an assurance that does not exist. If and when we achieve a certification, it will appear here with its scope and its audit date.
Implemented
Security overview
How we protect the systems we build and the client data held in this platform.
- Isolation enforced in the database
- Client project data is separated by PostgreSQL row-level security with a deny-by-default posture. Access requires active organisation membership and explicit project membership. A missed authorisation check in application code cannot become a cross-tenant data leak, because the database refuses the query.
- Least privilege throughout
- Service-role credentials exist only on trusted server code and are never present in a client bundle. Privileged tables and functions live in schemas that are not exposed through the API. Staff access requires explicit internal permission grants rather than inheritance from an email domain.
- Tested access boundaries
- Every role has both positive and negative access tests: what it may reach, and what it must not. Tests cover tables, storage paths, realtime channels and error behaviour, because a cross-tenant leak through a count or an error message is still a leak.
- Secure defaults in the application
- Content Security Policy, strict transport security, frame denial, referrer policy and permissions policy are set on every response. Authenticated surfaces are served no-store and marked noindex so they cannot be cached in a shared cache or indexed.
- Secrets management
- Secrets are held in environment configuration per environment, never committed to source, and never written to logs, fixtures or screenshots. Development, preview and production use separate credentials.
- Upload safety
- Files are validated server-side by inspected type rather than by the extension or the client-declared MIME value, held in private buckets under tenant-scoped paths, and served only through short-lived signed URLs with download auditing.
Implemented
Secure development lifecycle
Security work that happens during delivery rather than as a gate at the end.
- Threat modelling during design
- We identify trust boundaries, assets and abuse cases while the design is still cheap to change, and record the decisions taken as a result.
- Automated checks in the pipeline
- Dependency scanning, secret scanning, static analysis, type checking and linting run on every change and block on real failures rather than warning into a log.
- Peer review on every change
- No change reaches the main branch without review. The main branch is protected, and migrations are checked before they can be applied.
- Penetration testing before high-risk production use
- Independent testing is scheduled before a system handling sensitive data or money goes into production use. We report the findings and the remediation rather than the fact that a test occurred.
- Dependency currency
- Dependencies are updated on a defined cadence with an emergency path for critical vulnerabilities. Deferred findings carry a recorded reason.
Implemented
Privacy and data handling
What we collect, why, where it lives, and how long we keep it.
- Data minimisation in discovery
- The Project Architect deliberately does not ask for personal data about your customers, production credentials, or the contents of sensitive systems. We ask about categories and volumes, not records.
- Service communication separated from marketing
- Replying to your enquiry is service communication and is not optional. Marketing communication requires a separate, explicit opt-in that you can withdraw at any time without affecting service communication.
- Hosting and residency
- This platform is hosted on Vercel with its database and storage in Supabase’s London (eu-west-2) region. Where a client engagement requires a specific residency position, that is a design constraint agreed during Shape rather than something reconciled afterwards.
- Retention and deletion
- Retention periods are defined per data category. Deletion is implemented and tested rather than asserted. You can request export or deletion of your data through your client portal or by contacting us.
- Subprocessors
- We maintain a register of the third parties that process data on our behalf, what each one processes, and where. It is published below and updated when it changes.
Implemented
Responsible AI
What our AI may and may not do, and what we record about every run.
- AI does not commit on our behalf
- AI may structure ideas, suggest scope, summarise evidence, identify risks and draft artefacts. It does not issue final prices, make binding commitments, sign anything, reject a client, or publish an unreviewed claim. Those require a person.
- AI never silently changes your answers
- Anything AI produces is presented as a suggestion attached to what you actually wrote. Your original answer is retained. You can edit or reject every inference, and rejecting one is recorded.
- Disclosure
- AI-generated or AI-assisted content is labelled as such wherever it appears, including in chat and in generated artefacts.
- Instrumented runs
- Every AI run records its model, prompt version, inputs, outputs, cost, latency, any feedback and any human override — which is what makes a decision reconstructable months later.
- Redaction before egress
- Sensitive fields are redacted before content leaves our boundary, and provider data-use settings are configured per engagement rather than assumed.
- Evaluation before expansion
- We build labelled evaluation sets and run them in continuous integration before expanding a high-impact AI use case, so quality changes are measured rather than felt.
In progress
Business continuity and availability
Backups, recovery and what happens when something breaks.
- Backups
- The platform database is backed up by the managed database provider. Restore procedures are documented, and restore rehearsals are part of our operational routine.
- Rollback
- Application releases can be rolled back through the hosting platform. Database migrations are written with a forward or reverse path defined before they are applied.
- Incident response
- Incidents follow a defined process with a named commander, a communications path and a blameless review afterwards, with corrective actions tracked to completion.
- What we do not claim
- We publish no uptime percentage for this platform because we have no measurement period to publish. When we have operated it long enough to report honestly, the figure will appear here.
Implemented
Reporting a vulnerability
How to tell us about a security problem, and what we will do.
- How to report
- Email security@nellalabs.com with enough detail to reproduce the issue. If you would prefer to share it encrypted, say so in your first message and we will arrange a channel.
- What we commit to
- We will acknowledge your report, keep you informed of progress, and tell you when it is resolved. We will not pursue legal action against researchers who report in good faith, avoid privacy violations and data destruction, and give us reasonable time to fix the issue before disclosure.
- What we ask
- Do not access, modify or delete data that is not yours. Do not run denial-of-service testing. Do not use social engineering against our people or our clients.
- Recognition
- We do not currently operate a paid bug bounty. We will credit reporters publicly with their permission.
Subprocessors
Who else processes data on our behalf
Updated when it changes. Providers marked planned are not yet in use, and nothing is sent to them.
| Provider | Purpose | Data processed | Location | Status |
|---|---|---|---|---|
| Vercel | Application hosting, edge delivery and build infrastructure | Request metadata, IP addresses, application logs | United States, with edge delivery worldwide | active |
| Supabase | Database, authentication, file storage and realtime messaging | Account data, enquiry and project content, uploaded files | United Kingdom (London, eu-west-2) | active |
| Transactional email provider | Sending service email such as sign-in links and notifications | Email addresses, message content | To be confirmed on selection | planned |
| AI model provider | Generating draft artefacts inside the Project Architect | Project brief content you choose to submit for assistance | To be confirmed on selection | planned |
Certifications and audits
Currently: none
NELLA Labs holds no security certifications at this time. We will publish a certification here only once it has been achieved, with its scope, its certifying body and its audit date. If a certification is a procurement requirement for you, tell us during Explore and we will be straightforward about where we are.
Security questions
Bring us your security questionnaire
We would rather answer it honestly early than discover a blocker in procurement. A standard data processing agreement is available on request.