Security & privacy practices
01Trust at NEIGH
We sell security and compliance, so we hold ourselves to the bar we set for our customers. NEIGHPalm is built, run and audited against the same control sets we help others meet. This page is the public-facing summary of how. For deeper artifacts — reports, mappings, sub-processor list, DPA — request our trust pack.
02The five pillars
Encrypted by default
TLS 1.2+ in transit. AES-256 at rest. Centrally-managed key custody, rotation and access controls across all platform surfaces.
Least-privilege access
Production access is JIT, MFA-enforced, time-bounded and audit-logged. SSO included on Tier 2+. Role-based access on every surface, including AI interfaces.
Tenant isolation
Customer Data is logically isolated per tenant. AI fine-tuning effects are scoped to the tenant they originate from — never leaked to other customers or to public models.
Always-on monitoring
24/7/365 on-call alerting, behavioral baselines for production access, integrity monitoring on the audit-evidence vault, and continuous vulnerability management with SLAs.
Resilient by design
Multi-AZ, daily encrypted backups with quarterly restore drills, RPO 1h / RTO 24h on the platform’s critical paths. Tested business-continuity and incident-response runbooks.
Privacy-first AI
No training of shared or public models on Customer Data. Designated AI Interfaces only. Sub-processor model providers contracted with no-train, short-retention terms.
03How we govern AI
3.1 Designated AI Interfaces
The AI-vCISO interface, agentic governance modules and NEIGH-GI managed AI are the only sanctioned channels for AI interaction with the Service. Piping screens, exports or credentials into a third-party LLM, browser-use or coding agent is prohibited and detected.
3.2 No training on Customer Data
Customer Data is never used to train cross-tenant models. Where in-tenant adaptation is used, effects are scoped to that tenant.
3.3 Crawler & scraper posture
We publish robots.txt, X-Robots-Tag, noai/noimageai meta directives and TDM Reservation signals reserving rights under EU Directive 2019/790 Art. 4(3) and equivalents. Honoring these signals is required, not optional.
3.4 Output review
Every Output that affects an audit, regulatory submission, board representation or customer attestation is reviewed by a qualified human before release.
04Security program
| Domain | What we do |
|---|---|
| Governance | ISMS aligned with ISO 27001; risk register reviewed quarterly; security committee with executive accountability. |
| Identity & access | SSO, MFA enforcement, JIT production access, quarterly access reviews, automatic deprovisioning. |
| Application security | Threat modeling on every major feature, SAST & dependency scanning in CI, secrets scanning, hard-fail policy gates. |
| Cloud & infrastructure | Hardened baselines, CIS-benchmarked, infrastructure-as-code with policy-as-code (OPA) gates, segmented networking. |
| Vulnerability & threat mgmt | Ongoing vulnerability and threat management with best-of-practice SLAs for risk mitigation; AI-assisted scanners + authenticated scans; critical < 7d, high < 30d, medium < 90d. |
| Logging & monitoring | Centralized log aggregation, immutable audit trails, anomaly detection on production access and AI tool-use. |
| Penetration testing | Annual external penetration test; targeted re-tests after material changes; output summaries available under NDA. |
| Incident response | Documented IR runbooks, on-call rotation, customer notification SLAs, lessons-learned post-mortems. |
| Supplier risk | Sub-processor risk reviews before onboarding, annual reassessment, public sub-processor list with notice of changes. |
| People security | Background checks where lawful, mandatory annual training, role-based training for engineering and operations. |
| Business continuity | Tested DR plan, RPO 1h / RTO 24h on critical paths, quarterly restore drills. |
| Cryptography | TLS 1.2+; AES-256-GCM at rest; HSM-backed key custody; annual key-rotation review. |
05Privacy program
NEIGH operates a privacy program aligned with GDPR/UK GDPR, CCPA/CPRA, and equivalent regimes. Records of processing (Art. 30), data-protection impact assessments (DPIAs) on high-risk features, transfer impact assessments for cross-border flows, and a public DPA template are maintained and available.
Full detail: Privacy Policy.
06Sub-processors
We use a small set of vetted sub-processors to operate NEIGHPalm. The current list (with purpose, location and contractual terms) is published in our DPA sub-processor schedule. Customers receive at least 30 days’ notice of any addition before it goes live, with a right to object.
07Reporting a vulnerability
NEIGH operates an internal bug-bounty program for the paid platform and is happy to review submissions from ethical security researchers related to the NEIGHPalm product. Coordinated disclosures should be sent to operations@neigh.io with full details and a reliable reproduction.
A few things to keep in mind before you report:
- This is a marketing site. There is no functional connection between
neigh.io/neighpalm.comand the production NEIGHPalm platform. Findings against the marketing surface (missing security headers on a static page, theoretical CSP weaknesses, automated-scanner output, etc.) are not in scope. Please do not spam our inbox with these. - We run our own AI-driven vulnerability scanners and continuous internal testing across the paid platform. If your finding is something an automated scanner would surface, we very likely already have it on the queue.
- What we want to hear about. Report findings on the paid platform with a credible, demonstrated critical impact — RCE, authentication / authorization bypass that crosses tenant boundaries, customer-data exposure, key-material disclosure, sandbox escape, or comparable. If it is not critical, please spare our inbox.
- Rules of engagement. Stay within your own tenant; do not access, modify or exfiltrate Customer Data; do not run intrusive scans, brute-force, DoS or social-engineering attacks; give us reasonable time to remediate before any public disclosure. Researchers acting in good faith under these rules are protected — we do not pursue legal action against you.
08Contact
NEIGH Ltd · operations@neigh.io