Security Overview

The IMS runs on AWS infrastructure via Supabase, hosted in the US-East-1 region. Application servers are deployed on Vercel's edge network. Database servers are not publicly accessible — all connections route through authenticated API layers.

We use isolated compute environments per deployment. Production and staging environments are completely separated; no production data ever flows into staging. Infrastructure is defined as code, enabling reproducible and auditable deployments.

At rest: All data is encrypted at rest using AES-256. Encryption is applied at the storage level, meaning data is encrypted before it reaches disk, regardless of the data type.

In transit: All communication between clients and servers uses TLS 1.3. We do not support TLS 1.0 or 1.1. HTTP connections are redirected to HTTPS. API endpoints require HTTPS; plain HTTP requests return 301.

Secrets management: API keys, database credentials, and third-party integration tokens are stored in environment-level secret stores. They are never committed to version control and are rotated regularly.

The IMS uses a two-layer access control model. At the application layer, role-based access control (RBAC) determines which features and data a user can access within their organization. At the database layer, PostgreSQL row-level security (RLS) ensures that queries can never return data from a different tenant, regardless of application-layer bugs.

NAND Solutions engineers access production data only for legitimate operational purposes (e.g., debugging a customer-reported issue) and only with customer consent. All such access is logged.

Internal access to production systems requires multi-factor authentication. Access is provisioned on a least-privilege basis and reviewed quarterly.

Application and infrastructure metrics are monitored continuously. Alerting is configured for anomalous behavior including unusual query patterns, elevated error rates, and unexpected data access volumes.

Uptime monitoring is in place with 1-minute check intervals. Our SLA dashboard is updated in real time and available to customers at status.nandsolutions.com.

We have a documented incident response plan covering detection, containment, eradication, recovery, and post-incident review. In the event of a security incident affecting customer data, we will notify affected customers within 72 hours of becoming aware of the incident, as required by GDPR and consistent with our commitment to transparency.

Severity-1 incidents (active data breach or service unavailability) are escalated immediately to the founding team. Incidents are tracked in a private audit log and reviewed in post-mortems that are shared with affected customers.

We run a private bug bounty program. If you discover a security vulnerability, please report it to security@nandsolutions.com with a description of the issue, steps to reproduce, and — if possible — a proof of concept. We ask for responsible disclosure: please give us 90 days to remediate before publishing.

We acknowledge all reports within 48 hours and provide a status update within 10 business days. Qualifying reports are rewarded with a bounty payment; amounts are determined by severity, impact, and quality of the report.

In-scope: the IMS web application, API, and authentication system. Out of scope: social engineering, physical security, or attacks that require compromising a customer's own device.