Security Questionnaire

Does NemulAI have a formal information security policy?

Yes. We maintain a written information security policy covering access control, incident response, vulnerability management, and acceptable use. The policy is reviewed annually.

Does NemulAI conduct periodic security risk assessments?

We conduct internal security reviews and dependency audits. We have not yet engaged a third-party firm for penetration testing; we intend to before enterprise general availability. We are not SOC 2 certified and have not yet begun a formal audit.

Is there a designated security owner or team?

Yes. A named security owner is responsible for the security program, policy compliance, and coordinating incident response.

Does NemulAI have an incident response plan?

Yes. We maintain a written incident response plan covering detection, containment, eradication, recovery, and post-incident review. For breaches involving personal data, we follow GDPR 72-hour notification requirements.

How is data encrypted in transit?

All data in transit is encrypted using TLS 1.2 or higher. TLS 1.0 and 1.1 are disabled across all endpoints.

How is data encrypted at rest?

Data at rest is encrypted using AES-256, managed by Supabase. Database backups are also encrypted at rest.

What data does NemulAI collect from customer infrastructure?

The monitoring agent collects only GPU telemetry: power draw (W), temperature (°C), utilization (%), memory used/total, and process-to-job mapping. It does not access model weights, training data, or filesystem contents.

How long is customer data retained?

Metric data is retained for 90 days by default. Custom retention periods are not currently self-configurable; they can be arranged contractually. Users may request deletion at any time via the dashboard or by emailing privacy@nemulai.com.

Does NemulAI share customer data with third parties?

No customer data is sold or shared with third parties for advertising or analytics. Sub-processors (Vercel for hosting, Supabase for database, Resend for transactional email, Stripe for billing) are listed in the DPA.

Are database backups performed, and how are they secured?

Backups are managed by Supabase and encrypted at rest. Backup frequency, point-in-time recovery and geographic redundancy depend on our current Supabase plan — we will confirm the specifics in writing on request rather than assert them here.

Is customer data logically isolated from other customers?

Yes. Row-Level Security (RLS) policies are enforced at the database layer. Each authenticated user can only read and write rows associated with their own account. Service-role credentials are never exposed to client-side code.

How are API keys secured?

API keys use the prefix "alum_" followed by 59 random characters from a 54-character charset, providing approximately 340 bits of entropy. Keys are stored as SHA-256 hashes in the database — never in plaintext.

Does NemulAI enforce multi-factor authentication for internal systems?

Yes. Production database access and cloud console access require MFA for all authorized personnel.

Is the principle of least privilege applied to internal accounts?

Yes. Internal service accounts and personnel are granted only the minimum permissions required for their role. Access is reviewed periodically.

How are customer authentication sessions managed?

Customer sessions use Supabase Auth with secure HTTP-only cookies. Sessions expire after inactivity. Password resets use time-limited, single-use tokens.

Can enterprise customers use SSO / SAML?

Not currently available. Authentication is email and password, or a passwordless magic link using the PKCE flow. SSO/SAML is on the roadmap and is not implemented today.

How are API key rotations handled?

API key rotation is available via the dashboard (POST /api/user/profile with action: rotate_api_key). Rate-limited to 5 rotations per hour to prevent abuse. Old keys are invalidated immediately upon rotation.

Are there audit logs of access to sensitive operations?

Administrative and billing-relevant actions (plan changes, payments, API key rotation, report exports, admin operations) are recorded to an append-only audit table with actor, resource and timestamp, retained for 90 days. There is no customer-facing audit-log API today; extracts are available on request.

Where is NemulAI infrastructure hosted?

The application is hosted on Vercel (SOC 2 Type II certified). The database is hosted on Supabase (SOC 2 Type II certified). No customer data is stored on developer laptops or unmanaged systems.

Does NemulAI have a SOC 2 report?

NemulAI is pursuing SOC 2 Type I certification. In the interim, our infrastructure sub-processors (Vercel and Supabase) hold SOC 2 Type II certifications, available upon request.

What HTTP security headers does NemulAI set?

All responses include: Strict-Transport-Security (HSTS), X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, and a Content-Security-Policy.

How is the API protected against abuse?

Rate limiting is enforced at the API layer using a sliding-window algorithm: 100 requests/minute on the metrics ingest endpoint, 60 requests/minute on dashboard endpoints, and 5 API key rotations per hour.

Is there network segmentation between the application and database?

Yes. The application connects to the database via Supabase's managed connection pooling. Direct database access is restricted to authorized personnel over MFA-protected connections; it is not publicly accessible.

Does NemulAI support high availability and disaster recovery?

The application tier is served from Vercel's globally distributed edge network and the database is managed by Supabase. We have not performed a documented disaster-recovery test, so we do not publish an RTO or RPO target we could not evidence.

How does NemulAI validate input data from agents?

Server-side validation is applied to all ingested telemetry: power must be 0–1500 W, temperature must be 0–120 °C, and timestamps must fall within 5 minutes of the server clock. Out-of-range values are rejected with a 422 error.

Are Stripe webhook signatures verified?

Yes. All incoming Stripe webhook events are verified using Stripe's signature verification (stripe.webhooks.constructEvent) before any processing occurs.

How are dependencies managed and scanned?

Python agent dependencies are pinned to exact versions in requirements.txt. Node.js dependencies use npm with a lockfile. CI runs npm audit and pip-audit on every pull request.

Does NemulAI conduct code reviews?

NemulAI is currently a single-engineer team, so production changes do not receive independent human review. Automated gates run on every change: TypeScript, ESLint, a SQL migration linter and the full test suite. Independent review will be introduced as the team grows.

Is there a vulnerability disclosure program?

Yes. Researchers may report vulnerabilities to security@nemulai.com. We acknowledge within 2 business days and aim to resolve critical issues within 30 days. We credit researchers who disclose valid vulnerabilities.

How does NemulAI protect against OWASP Top 10 vulnerabilities?

We apply defense-in-depth: parameterized queries prevent SQL injection, RLS enforces authorization at the DB layer, CSP and X-Frame-Options mitigate XSS/clickjacking, all user input is validated server-side, and dependencies are scanned for known CVEs.

What permissions does the monitoring agent require on host systems?

The agent reads GPU telemetry via NVML (NVIDIA Management Library). It runs as a dedicated non-root system user ("nemulai") with minimal permissions. It does not require access to model weights, training data, or general filesystem contents.

How is the agent hardened when deployed via systemd?

The provided systemd unit applies: NoNewPrivileges=true, PrivateTmp=true, ProtectSystem=strict, ProtectHome=true, and RestrictSUIDSGID=true.

What happens if the agent loses network connectivity?

The agent uses a local Write-Ahead Log (WAL) to buffer metrics during outages. Upon reconnection, buffered metrics are uploaded with exponential backoff. No metrics are lost during temporary network interruptions.

Is mTLS supported for environments requiring mutual authentication?

Not currently supported. Agent traffic uses TLS with API-key authentication. Mutual TLS is not implemented.

Is the agent source code available for review?

Yes. The agent source code is published at github.com/AgentMulder404/NemulAI under the MIT License.

Is NemulAI GDPR compliant?

NemulAI acts as a data processor for customer personal data. Our DPA covers GDPR Article 28 requirements including sub-processor lists and data subject rights. On a breach we notify affected customers without undue delay and assist them in meeting their own obligations, including GDPR Articles 33 and 34 — the 72-hour supervisory-authority deadline sits with the controller, not the processor.

Does NemulAI offer a Data Processing Agreement (DPA)?

A standard DPA is published at nemulai.com/legal/dpa. It is not pre-signed; request a countersigned copy at kevin@nemulai.com and we will execute it.

Does NemulAI offer a Master Services Agreement (MSA)?

Yes. An MSA template is available to enterprise customers. Contact sales@nemulai.com to initiate the contracting process.

What is NemulAI's uptime SLA for enterprise customers?

We do not currently offer a contractual uptime SLA or service credits. Hosting is on Vercel and Supabase, whose own availability commitments apply upstream. An SLA can be negotiated as part of an enterprise agreement.

Where can I find the current service status?

Real-time and historical status is available at nemulai.com/status. The status page polls the health endpoint every 30 seconds and checks the ingest endpoint availability.