Our Security Foundation

At Nusu Inc., security is fundamental to earning and maintaining your trust. This page summarizes current practices and links to our Privacy Policy for details on data handling and sharing.

Infrastructure Partners

We build on established infrastructure providers:

• Vercel hosts our application. See their security page for details
• Neon provides our database infrastructure. See their security page for details
• Cloud infrastructure services include Amazon Web Services (AWS)

Core Security Practices

We implement fundamental security measures across our platform:

• Protected Routes: Account and admin surfaces require authentication
• Rate Limiting: Sensitive routes are protected with edge rate limits
• Security Headers: CSP and HSTS are configured for the platform
• Input Validation: Zod validation and parameterized queries reduce common injection risks

API Security

Our API is designed with security as a priority:

• Authentication: Most API endpoints require authentication; public health checks are unauthenticated for uptime monitoring
• Request Controls: Requests are validated and constrained with rate limits where appropriate
• Webhook Verification: Third-party webhooks (for example, Stripe) verify signatures before processing

Data Protection & Privacy

Our Commitment

• Sensitive identifiers (for example, tax IDs) are encrypted at rest
• Backups are encrypted in transit and at rest as part of our disaster recovery plan
• PII minimization and IP hashing are implemented in our trust and privacy system

Compliance Considerations

While we're in the early stages of formal compliance certifications, we rely on infrastructure providers that publish their own security documentation. If you have specific compliance requirements, contact us at team@nusu.ai.

Account & Data Requests

For data access or deletion requests:

• Use the Data Request page or email team@nusu.ai
• Requests are handled in accordance with applicable data protection laws
• See our Privacy Policy for data categories and sharing practices

Working With Us

Getting Security Documentation

As we continue to build out our security program, we're happy to discuss our security practices in more detail. Please reach out to our team at team@nusu.ai for:

• Security questions
• Available documentation about our practices
• Specific compliance or security requirements your organization may have

Reporting Security Issues

If you discover a potential security issue, please report it to us immediately at team@nusu.ai. We take all reports seriously and will follow up as quickly as possible.

When reporting, please include:

• A clear description of the issue
• Steps to reproduce (if applicable)
• Any relevant proof of concept

Responsible Disclosure

We appreciate the security research community's efforts in helping keep our platform secure. If you're conducting security research:

Please Do:

• Report findings directly to our security team
• Allow us time to address issues before public disclosure
• Delete any data obtained during research after reporting

Please Don't:

• Access or modify customer data
• Perform destructive testing or cause service disruptions
• Use automated scanning tools that could impact service availability

Our Ongoing Commitment

Security is an ongoing journey, not a destination. As Nusu grows, we're committed to:

• Continuously improving our security practices
• Maintaining transparency about our security posture
• Investing in additional security measures and certifications based on customer needs
• Regular security reviews and updates

For any security-related questions or concerns, please don't hesitate to contact us at team@nusu.ai.