Security & Trust

Attestation reports and certificates available under NDA via the security package request below.

• In transit: TLS 1.3 on all ingress, HTTP/2 and HTTP/3 supported. Agent ↔ edge, client ↔ edge, and intra-service traffic all encrypted.
• At rest: AES-256 for database volumes and object storage. Customer configuration (auth tokens, webhook secrets, endpoint credentials) is additionally envelope-encrypted with per-record keys.
• Key management: Cloud-provider KMS with HSM-backed keys. Automated rotation every 90 days; manual rotation on-demand.
• Passwords: bcrypt (cost factor 12+). No plaintext credentials are ever stored, logged, or transmitted.
• Mutual TLS: Per-endpoint client-certificate enforcement at the TLS handshake. Reject invalid clients before any HTTP request is parsed. See the mTLS docs.

• Customer authentication: Short-lived JWTs for API auth with strict IDOR protection. SSO via SAML 2.0 and OIDC (Google, GitHub, Azure AD, Okta) on Pro plans and up.
• Multi-factor authentication: TOTP-based 2FA on every account. Enforceable org-wide on Enterprise.
• Role-based access control: Organizations model with named roles, per-resource permissions, and audit-logged role changes.
• Internal access: Ngris engineers access production only through a break-glass procedure; every session is time-boxed, approved, and audit-logged. No shared admin credentials.
• Session management: Idle timeout, concurrent-session limits, device fingerprinting, and alerting on anomalous login patterns.

• Secure development lifecycle: Threat modeling for every major feature, mandatory code review (with a second reviewer for security-sensitive changes), and a security champion in every team.
• Automated scanning: SAST, dependency scanning, container image scanning, and secret scanning run on every pull request and nightly against production images. Findings block merges.
• Penetration testing: Annual third-party pen test covering app, infra, and agent protocols. Critical findings remediated within SLA; summary report available under NDA.
• Bug bounty: Private program with safe-harbor policy. Qualifying reports receive bounties and public credit (opt-in).

• Least privilege: All services run in hardened containers as non-root users. IAM roles scoped per service; no long-lived cloud credentials.
• Network segmentation: Production databases and critical components are on private networks, not exposed to the public internet. Every flow is explicitly allow-listed.
• Edge DDoS protection: Layer 3/4 volumetric protection via upstream provider. Application-layer rate limiting and WAF rules per endpoint.
• Physical security: Production infrastructure runs on SOC 2 / ISO 27001 certified cloud providers. Physical access is provider-controlled; no Ngris personnel has physical access to servers.
• Host hardening: CIS benchmark baseline, automated patching, and runtime threat detection on every host.

• Inspector data: Retention varies by plan (Free: 3 days, Pro: 15 days, Unlimited: 30 days, Enterprise: configurable up to 90 days). Automatically purged after retention window.
• Traffic logs: Metadata-only logs retained per plan terms. Full request/response bodies only captured when Inspector is explicitly enabled on an endpoint.
• Audit logs: Admin and API actions retained 12 months (extendable on Enterprise). Exportable on request.
• Account deletion: On account closure, customer data is deleted from primary systems within 30 days and from backups within 90 days. Certificate of deletion available on request.
• Secret redaction: The Inspector automatically detects and masks API keys, tokens, passwords, and private keys before persisting request data.

• Edge regions: US, EU, and APAC. Traffic is served from the nearest region; you can pin an endpoint to a specific region on Pro plans and up.
• Data-at-rest residency: Account data is stored in the customer's home region. EU customers' data stays in the EU.
• Cross-region transfers: When they occur (e.g. global Inspector aggregation), they are governed by EU Standard Contractual Clauses (SCCs) and documented in the DPA.
• Dedicated infrastructure: Enterprise customers can run in a dedicated region or single-tenant edge pod on request.

The third parties we use to deliver the service. All have DPAs in place and meet SOC 2 / ISO 27001 standards.

Customers are notified 30 days in advance of subprocessor additions or changes that materially affect their data processing. Subscribe via the DPA to receive notifications.

• 24/7 on-call rotation with automated paging. Mean time to ack under 5 minutes for SEV1.
• Public status page at status.ngris.com. Subscribe to email/SMS/webhook notifications.
• Customer notification: Material security incidents reported to affected customers within 72 hours, with regulatory notifications per GDPR / CCPA / state-breach-law timelines.
• Post-mortems: Published for every SEV1 and SEV2 incident. Root cause, timeline, corrective actions.
• Tabletop exercises: Quarterly incident-response drills; annual third-party-observed exercise for SOC 2.

• Multi-region architecture: Control plane and data plane run active-active across multiple regions. Region failure is handled by automatic failover.
• Backups: Encrypted, daily full + continuous incremental, with cross-region replication. Retention: 30 days. Quarterly restore tests verified in production-like environments.
• RTO / RPO: RTO ≤ 1 hour for full regional loss, RPO ≤ 5 minutes for database state. Tested quarterly.
• Availability target: 99.99% monthly uptime on Unlimited and Enterprise plans. Financially-backed SLA on Enterprise with service credits.

• Background checks: Pre-employment background checks for every Ngris employee with production access, where legally permitted.
• Security training: Onboarding training plus annual refresh. Phishing simulations quarterly. Role-specific training for engineers handling production.
• Confidentiality: NDAs at hire, reinforced at offboarding. IP assignment agreements for all contributors.
• Device management: MDM on every corporate device. Full-disk encryption required. Lost/stolen devices remote-wipeable.
• Offboarding: Credentials revoked within 4 hours of termination. Exit interviews include security obligations reminder.

• Patch SLAs: Critical CVEs patched within 24 hours. High within 7 days. Medium within 30 days. Tracked in a public-facing dashboard for auditors.
• Dependency hygiene: Automated dependency updates (Dependabot-style) with mandatory review. All transitive deps scanned.
• Container scanning: Every image scanned at build time and hourly at runtime. Vulnerable images blocked from deployment.
• Threat intelligence: Subscribed to CISA, US-CERT, and vendor advisories. Zero-day response protocol documented and drilled.

Procurement, vendor-review, or security teams evaluating Ngris can request the full package, delivered under mutual NDA:

• Latest SOC 2 report (when available) or gap analysis
• Third-party penetration test summary
• CAIQ v4 and SIG Lite pre-filled responses
• Data Processing Agreement (DPA)
• Business Associate Agreement (BAA) template for HIPAA customers
• Certificate of insurance (cyber + E&O)
• Business continuity & DR plan summary
• Architecture & data-flow diagrams

If you believe you've found a security vulnerability, report it responsibly to security@ngris.com.

• Response SLA: Acknowledged within 1 business day, triage within 3 business days.
• Safe harbor: Good-faith security research is authorized. No legal action against researchers who follow the policy.
• Bounties: Qualifying findings receive rewards based on severity and impact. Public credit available on request.
• PGP key: Available on request for sensitive disclosures.