Security & Trust

We are transparent about our certification status. Below is where we stand today — nothing here is claimed as held unless it is marked "In place."

• In transit: TLS 1.3 on public ingress, with HTTP/2 and HTTP/3 (QUIC) support. Traffic between the agent and the edge, and between clients and the edge, is encrypted.
• At rest: Sensitive customer configuration (auth tokens, webhook secrets, endpoint credentials) is encrypted at the application layer before storage.
• Passwords: Hashed with bcrypt. Plaintext passwords are never stored.
• Mutual TLS: Per-endpoint client-certificate enforcement is available, rejecting invalid clients at the TLS handshake. See the docs.

• Customer authentication: Token-based API authentication with per-object authorization checks. Single sign-on via SAML 2.0 and OIDC is available on paid plans.
• Multi-factor authentication: TOTP-based 2FA is available on accounts.
• Role-based access control: Named roles and per-resource permissions for team accounts, with audit logging of sensitive changes.
• Internal access: Access to production systems is limited to authorized personnel and protected by strong authentication. We are formalizing least-privilege and access-review processes as the team grows.

• Secure development: Changes go through code review, and we run internal security reviews on security-sensitive features.
• Dependency & secret scanning: We use automated scanning of dependencies and check for committed secrets in our pipeline.
• Independent testing (planned): We intend to engage third-party penetration testing and to run a coordinated vulnerability-disclosure program as we grow. We do not currently operate a paid bug-bounty program.

• Container isolation: Services run in containers under Kubernetes. Application workloads run with reduced privileges.
• Network segmentation: Databases and internal components are on private networks and are not directly exposed to the public internet.
• Edge protections: Application-layer rate limiting, WAF rules, IP/geo restrictions, and bot-management rules can be configured per endpoint.
• Multi-region edge: We operate edge presence in multiple regions to serve traffic closer to users.
• EU data residency: Customer personal data is stored and processed in the European Union. A limited set of sub-processors (see below) may process specific data elsewhere where their service requires it — most notably Stripe for payments. See our DPA for the transfer safeguards that apply.

• Inspector data: Captured request/response data is retained according to your plan's retention window and automatically purged afterward. Full request/response bodies are only captured when the Inspector is explicitly enabled on an endpoint.
• Account deletion: When you close your account, we delete your personal data within 30 days, except where we are required to retain it by law. See our Privacy Policy.
• Secret redaction: The Inspector masks common secrets (API keys, tokens, passwords) in captured data.

The main third parties we rely on to deliver the service. Contact us for the current, detailed list referenced in our DPA.

We will give business customers reasonable advance notice of new subprocessors that materially affect the processing of their data, as described in the DPA.

• Monitoring: We monitor the platform and investigate anomalies. Service status is published at our status page.
• Breach notification: If a security incident affects your personal data, we will notify affected customers and, where applicable, supervisory authorities within the timelines required by GDPR, CCPA, and other applicable law.
• Post-incident review: We conduct reviews of significant incidents to identify and address root causes.

If you believe you've found a security vulnerability, please report it responsibly to security@ngris.com.

• Good-faith safe harbor: We will not pursue legal action against researchers who report vulnerabilities in good faith, avoid privacy violations and service disruption, and give us reasonable time to remediate before disclosure.
• Acknowledgement: We aim to acknowledge reports promptly and keep you informed as we investigate.

Evaluating Ngris and need more detail — a DPA, our current subprocessor list, or answers to a security questionnaire? Reach out and we will respond honestly about what we have in place today.