NEBU gets no free pass.
Seeing every identity on your infrastructure is a start. Trusting it takes proof of what each one did, and a system built to give you that proof has to pass the same checks itself.
Book a callZero trust. Even NEBU can’t vouch for itself.
Inside your boundary, NEBU is one more workload to verify.
Its own parts prove who they are to each other on every call and hold rights to one action at a time, so no part of NEBU can lend its trust to another.
How we secure NEBU itself.
Code
Every change is reviewed before it merges, and dependencies and secrets are scanned on the way in.
Releases
Every release and update bundle is signed, and verified before it installs, air-gapped sites included.
Data
Zero retention of raw infrastructure data. NEBU runs where your infrastructure runs, so that data stays in your custody.
Your security review, ready on request.
Ask for any of these and we send them to your security team.
- Security questionnaire answers
- Policies: information security, access, incident response and data handling
- Architecture deep dive, under NDA
- Penetration test
- Our self-assessment against SOC 2, ISO 27001, ISO 42001 and DORA
Report a vulnerability.
Write to security@thenebu.com with what you found, how to reproduce it and the impact you expect.
We acknowledge every report within two business days. If you act in good faith, stay within this policy and give us time to fix the issue before you share it, we will not take legal action against you. Please don’t access data that isn’t yours, disrupt a service or test our people.
The same address is published in our security.txt file.
Questions
Does verifying every call slow NEBU down?
A little, by design. Each check adds time to a step, and in return nothing in NEBU acts on trust alone.
Where do we send our security questionnaire?
Through the contact form under Security review, or to security@thenebu.com. We answer it with the documents listed above.
Put NEBU through your review.
On a call, we take your security team through the deployment, the controls and the documents, one question at a time.