Data Security and Privacy

This page describes the security controls that protect customer data in NeoSigma and our responsible disclosure policy.

NeoSigma has completed a SOC 2 Type II audit, performed by an independent third-party auditor over a three-month observation window ending 31 July 2026. The report is available on request under NDA. Controls are monitored continuously through Vanta, and current compliance status is published on the NeoSigma Trust Center. Customer data is processed and stored in accordance with applicable data protection regulations, including GDPR.

Audit logs are maintained for all security-relevant actions, including logins, access changes, and API key lifecycle events. Security policies are reviewed annually, alongside an incident response tabletop exercise.

At Rest

Customer data is encrypted at rest with AES-256. Secrets and credentials are stored in GCP Secret Manager, never in source code.

In Transit

All data in transit is encrypted with TLS 1.2 or higher.

NeoSigma is hosted on Google Cloud Platform in the us-central1 region. Application workloads run on Cloud Run, a fully managed serverless platform with no persistent server access. The production database runs on Cloud SQL (PostgreSQL) with automated daily backups and point-in-time recovery.

Authentication uses Google OAuth. NeoSigma does not store passwords. Within an organization, access is governed by role-based access control.

Internally, service accounts follow least privilege, with custom IAM roles scoped to the minimum required permissions. Production access is restricted to named engineering personnel and reviewed at least quarterly. Employee access is revoked as part of offboarding, targeting within 24 hours.

All code changes require peer review before merging to production. An automated CI pipeline runs dependency audits and security checks on every pull request. API tokens are SHA-256 hashed at rest, with the plaintext shown once at creation and never persisted. Webhook signatures are verified with HMAC-SHA256 using timing-safe comparison.

Customer data is not used to train models for other customers. Each organization's data is isolated at the query layer, and cross-organization access is prevented by design.

NeoSigma uses the following third-party subprocessors to deliver the service:

To report a security vulnerability, email founders@neosigma.ai. Reports are acknowledged within 2 business days.

We will not pursue legal action against researchers who act in good faith, stay within the stated scope, avoid privacy violations and service disruption, and comply with applicable law.

In-scope Systems

• neosigma.ai and all subdomains

• NeoSigma platform application and API

• NeoSigma agent runner infrastructure

For security questions, email founders@neosigma.ai.