Frameworks we hold, frameworks we are landing, and the documents your auditor needs. No vendor-questionnaire roulette — every answer is here.
Status per framework, never overstated
Enforced by tests + RLS, not periodic audits
Sent within 24 hours of request
30-day notification on changes
Status comes straight from one data source and is never restated by hand — achieved, in progress, or available on request. We will not call anything certified until the report is signed.
Nemo Router operates SOC 2-aligned security, availability, and confidentiality controls today — encryption, access control, change management, audit logging, tenant isolation. A formal SOC 2 Type II observation period is underway; the audited report is targeted for Q3 2026. Our infrastructure substrate (Google Cloud Run, Supabase) is already SOC 2 Type II certified.
Controls walkthroughInformation security management practices aligned to ISO/IEC 27001 Annex A controls — asset management, access control, cryptography, operations security, supplier relationships. A formal ISO 27001 certification is on the roadmap; the infrastructure substrate (Cloud Run, Supabase) is independently ISO 27001 certified.
Controls walkthroughCompliant with the EU General Data Protection Regulation. Data Processing Addendum available for signature, EU Standard Contractual Clauses with subprocessors, data-subject access and erasure tooling built into the dashboard, and EU data residency available on Enterprise.
Read the DPANemo Router supports HIPAA-eligible workloads. A Business Associate Agreement (BAA) is available for healthcare customers processing protected health information — request one through the Enterprise team. PII redaction guardrails run on every request at no extra cost.
Request a BAANemo Router never touches raw cardholder data. All payments are processed by Stripe, a PCI DSS Level 1 certified service provider; card numbers are tokenized client-side and never reach our servers or database. Your PCI scope for using Nemo Router is therefore minimal.
How payments workPin where customer data is processed and stored. US is the default footprint; EU residency is generally available on Enterprise, with UK, Canada, Australia, Singapore, and India available on request for residency-sensitive workloads.
Residency mapSOC 2 (Type II audit in progress)
GDPR
HIPAA
PCI DSS (delegated to Stripe)
The control catalog auditors ask to see, in one table. No marketing fluff between the rows.
| Measure | Implementation |
|---|---|
| Encryption in transit | TLS 1.2+ (HSTS preloaded) |
| Encryption at rest | AES-256 across Postgres, Redis, object storage |
| Database isolation | Row-Level Security on every Nemo table |
| API key storage | SHA-256 hashed; plaintext shown once |
| Auth | JWT via Supabase Auth + service-role isolation |
| Credit safety | Reserve+settle with atomic credit mutations |
| Data retention | Configurable per-org (zero / metadata / full / redacted) |
| Log retention | 90 days, auto-purged daily; longer on Enterprise |
| Financial records | 7 years (legal obligation) |
How these controls fit together — request path, RLS, reserve+settle — is on the security page.
Signed DPAs, BAAs, vendor questionnaires, and security exhibits go to qualified organizations on request. We respond within one business day.
Trust, in writing
One inbox, one team, one business-day SLA. Bring your auditor along on the kickoff call.