Trust Center

Security and trust at NAND.

We handle your inventory and operations data with the same engineering standards we apply to our code. Concrete commitments, honest status.

COMPLIANCE

Compliance Status

Standard	Status	Notes
SOC 2 Type II	In Progress	Audit expected Q3 2026. Controls are in place; currently gathering evidence.
GDPR	Compliant	DPA available. Data processing limited to EU-standard-compliant sub-processors.
ISO 27001	Planned	Planned for 2027 following SOC 2 Type II completion.
HIPAA	N/A	NAND Solutions does not process protected health information (PHI).

SECURITY

AES-256 at rest, TLS 1.3 in transit. All data encrypted before it touches disk.

Daily encrypted backups with 30-day retention. Point-in-time recovery available on Gold plans.

Role-based access control (RBAC) combined with PostgreSQL row-level security. Tenant data is always isolated at the database layer.

Every mutation logged with before-and-after state, user identity, and timestamp. Logs are immutable and retained for 365 days.