NEI Security Measures

This page describes the technical and organisational measures NEI implements to protect data processed on the platform, in accordance with GDPR Article 32. It is subject to change as described in Section 11. It is referenced by the NEI Data Processing Addendum and applies to the platform, the website, and NEI's supporting infrastructure.

1. Governance

Security and privacy are owned directly by NEI's founding team, with the CTO responsible for the platform and infrastructure. Measures are reviewed as the platform evolves. NEI maintains an internal data inventory and retention schedule that drives what is collected, kept, and deleted.

2. Personnel and access

Access to production data is strictly controlled and limited to authorised NEI personnel, on a need-to-know basis, bound by confidentiality. Authorised personnel access production data to operate, support, and develop the platform. Personal data is never shared externally except as described in the NEI Privacy Policy.

3. Access control and encryption

• Invitation-only accounts. There is no self-registration; every platform account is created and vetted by an NEI administrator.
• Authentication. Passwords themselves are never stored; sign-in is verified against salted one-way hashes (bcrypt).
• Two-step sign-in verification. Every login, for every role including administrators, additionally requires a single-use security code sent to the account's email address. Codes are stored hashed only, expire after 10 minutes, and are attempt- and rate-limited.
• Session expiry. Signed-in sessions expire after 60 minutes of inactivity; there is no long-lived "remember me".
• Role-based access. Platform access is governed by roles; administrative functions require the administrator role.
• Deal-level access. Deal content is visible only to the parties of the transaction according to the platform's party-side, stage, and per-document visibility rules.
• Least-privilege service accounts. The public website's database role is read-only and restricted to the minimum data it serves; it cannot read platform content.
• Secrets management. Credentials and tokens are held in Google Secret Manager, injected at runtime; integration tokens are stored encrypted.
• Encryption in transit and at rest. All traffic is served over TLS; data at rest is encrypted by Google Cloud's managed encryption.

4. Confidentiality, integrity, availability, resilience

• Injection resistance. All database operations use parameterised queries.
• Append-only records. Deal revisions, activity logs, and terms acceptances are append-only, preserving an audit trail of changes.
• Backups. Rolling [7]-day database backups with deletion protection on the production database; uploaded documents are stored in versioned cloud storage.
• Managed infrastructure. Services run on Google Cloud Run behind a managed load balancer with rate limiting and a web application firewall; infrastructure is defined as code.
• Monitoring. Access logging for security monitoring (30-day retention), infrastructure logging and error reporting via Google Cloud; administrative actions on production infrastructure are captured by the cloud provider's audit logging.
• External data feeds. Any external data feed (for example to our market-data partner) is authenticated via dedicated service accounts (cloud invoker rights) and gated so that only the approved data scope is accessible.

5. Protection during transmission

All connections - website, platform, and administrative - are encrypted with TLS behind Google Cloud load balancing. There is no unencrypted access path.

6. Physical security

NEI's services are hosted in Google Cloud data centres and inherit Google's physical security controls and compliance certifications (ISO 27001, SOC 2, et al.). NEI holds no production data on physical premises.

7. Data minimisation

• The public website sets no cookies and uses no analytics or third-party trackers; the platform sets only strictly necessary session cookies.
• IP addresses appear only in infrastructure logs, retained ~30 days for security and abuse prevention.
• Data is collected and retained per the retention schedule summarised in the NEI Privacy Policy; what is not needed is not collected.

8. Data subject rights

NEI supports access, rectification, erasure, restriction, and objection requests as described in the NEI Privacy Policy, and assists platform users with data-subject requests concerning Submitted Data per the Data Processing Addendum.

9. Subprocessors

NEI uses a small set of subprocessors - Google Cloud Platform (hosting, storage, logging) and Google Workspace (email) - under Art. 28 terms; the current list is maintained in the Data Processing Addendum. NEI reviews subprocessors' security posture and certifications.

10. Incident response and breach notification

NEI investigates suspected security incidents without undue delay and notifies affected controllers of personal-data breaches per the Data Processing Addendum, and supervisory authorities and data subjects where the GDPR requires. Suspected vulnerabilities can be reported to contact@nei.io; NEI asks reporters to practice responsible disclosure.

11. Changes to this page

These measures evolve with the platform. This page is versioned; material changes are announced on the platform and reflected in the dates shown on this page.