What we do, and what we don't.
Boring technology, no telemetry, EU-first data residency. The full technical measure list is in our DPA.
Updated:
Defaults.
Where we host
This marketing site runs on Cloudflare Workers, which is a global anycast edge — not an EU-pinned region. Product runtimes run on our own infrastructure: the EU (Germany, France) for the EU products, and North America (Canada) for PropVector AI and the North-America micro-SaaS. TLS in transit. Backups encrypted at rest.
Encryption
HTTPS enforced (HSTS preload). TLS 1.3 minimum. Passwords hashed with Argon2id. Database column-level encryption for the highest-sensitivity fields (per-system C2PA manifest hashes, payment secrets).
No telemetry
We do not run Mixpanel, Amplitude, Segment, or any third-party analytics on our products. We do not sell customer data. We do not profile end users for advertising.
Secret management
Three-tier credential strategy: an integrated operations layer for live work, long-lived scoped tokens for runtime, and short-lived full-access tokens only for administrative tasks. No secrets in code. No secrets in git history. No SDK keys on client devices.
Access control
Role-based (admin / user). Per-organization memberships. Cloudflare Access in front of internal admin tools. MFA required for all admin accounts.
Backups
Daily backups of every product database. 30-day retention. Backups stored encrypted on Koofr (EU) with immutable retention. Monthly restore drill.
When something goes wrong.
Breach notification
We notify affected customers within 72 hours of becoming aware of a personal-data breach, per GDPR Art. 33. Notification includes: nature of the breach, categories and approximate number of data subjects, likely consequences, and measures taken.
Detection
Service-availability and resource-saturation monitoring on infrastructure we host. Cloudflare DDoS protection. An audit trail for authentication anomalies.
Response
On-call first responder: the studio founder. Decision-tree runbooks for: 5xx spike, suspicious auth, leaked credentials, data exposure, dependency CVE. Rollback to the previous release image.
Post-mortem
Blameless post-mortem within 5 business days of any sev-1 or sev-2 incident. Published internally; summary shared with affected customers on request.
Reporting a vulnerability.
We do not have a paid bug bounty program. We do commit to respond within 5 business days and credit researchers in our post-mortems.
Common security questions.
Where is our data processed?
Product runtimes run on dedicated infrastructure in the EU (Germany and France), and in North America (Canada) for the North-America products. TLS in transit. This marketing site runs on Cloudflare Workers, a global anycast edge rather than an EU-pinned region.
Do you track visitors or end users?
No third-party analytics run on the products — no Mixpanel, Amplitude or Segment — and no end-user profiling for advertising. This site runs one consent-gated analytics tool in its EU region, which loads only after an explicit opt-in and sets no cookies.
Can we sign a Data Processing Agreement?
Yes. A DPA compliant with GDPR Article 28, and with the UK GDPR where applicable, is available for customers who are themselves data controllers. A summary is published, and the full agreement is provided on request.
How quickly would we hear about a breach?
Within 72 hours of us becoming aware of a personal-data breach, per GDPR Article 33. The notification states the nature of the breach, the categories and approximate number of data subjects affected, the likely consequences, and the measures taken.
How are backups handled?
Daily backups of every product database, encrypted at rest, with 30-day retention and immutable retention at an EU storage provider. A restore drill is run monthly — a backup that has never been restored is not a backup.
How do I report a security vulnerability, and what happens next?
Report it to admin@nestlab.tech, and we commit to respond within 5 business days and credit researchers in our post-mortems. There is no paid bug bounty program. On-call response runs from the studio founder, using decision-tree runbooks for 5xx spikes, suspicious auth, leaked credentials, data exposure and dependency CVEs. A blameless post-mortem follows within 5 business days of any sev-1 or sev-2 incident, published internally, with a summary shared with affected customers on request.