Trust & Security
Nezzo processes procurement and operational data on behalf of our customers. This page describes how we protect it, who else processes it, and how to reach our security team.
Compliance
Security category, examined against the AICPA Trust Services Criteria. Report available to customers and prospects under NDA.
Performed by an external security provider and repeated annually. Executive summary available under NDA.
Our sub-processors are published on this site. A data processing agreement and formal sub-processor change notice are being finalised — contact legal@nezzo.io for the current position.
How we protect your data
Tenant isolation
Each customer's data is held in a dedicated database schema rather than a shared table filtered by application code. Every data access is scoped to a single tenant at the data-access layer.
Isolation is verified by automated tests that run on every deployment, including deliberate cross-tenant access attempts. A failure blocks the release.
Encryption
Data in transit is encrypted using TLS 1.2 or higher. Data at rest is encrypted using AES-256 with managed keys held in a dedicated key management service. Backups are encrypted to the same standard.
Access control
Access is granted on the principle of least privilege and need-to-know. Every individual has a unique named account; shared accounts are not permitted for human access. Multi-factor authentication is required for production systems, source control and cloud infrastructure.
Access is authorised on joining, adjusted on role change, revoked on departure, and reviewed periodically. Credentials are held only in a managed secrets vault, never in source code, configuration or logs.
Secure development
Every change is peer-reviewed against a documented security checklist and merged through a protected branch. Required automated checks must pass before a change can be merged, and a failing check blocks it.
A software bill of materials is generated for every build, and container images are scanned for known vulnerabilities and dependency licence compliance before release. Findings at or above our defined severity threshold prevent publication.
Infrastructure
The service runs on infrastructure operated by a major cloud provider whose physical and environmental controls are independently audited. Nezzo operates no data centres.
All infrastructure is defined as code and peer-reviewed before deployment. Production runs in a private network with segmented subnets; data stores are not reachable from the public internet.
Monitoring and resilience
Security-relevant events are logged centrally and retained, and administrative changes to production are recorded. Findings from automated scanning are routed to a central security service and alerted.
Databases are backed up automatically with point-in-time recovery. Restoration is tested and recovery time measured.
People
Background screening is completed for personnel in security-relevant roles before access is granted. All personnel and contractors complete security awareness training at onboarding and annually, and acknowledge our security policies individually.
All endpoints are centrally managed with enforced device policies and malware protection.
Incident response
We maintain a documented incident response plan defining severity criteria, escalation paths and notification. Suspected incidents are reported immediately to the CTO as Information Security Officer, and are recorded, contained, investigated and closed with a documented review.
Where an incident affects customer data, we notify affected customers in line with our contractual and regulatory obligations.
Privacy
We act as a processor in respect of customer data. We do not sell it and do not use it for any purpose other than providing the service.
We operate a documented privacy risk assessment procedure. Changes that process personal data are screened against defined criteria — new categories of data subject, special category data, automated decision-making, new sub-processors, new processing regions, extended retention, wider visibility, scale, and the combination of previously separate datasets. Anything the screening flags triggers a full assessment recording the purposes of processing, its necessity and proportionality, the risks to individuals with likelihood and severity ratings, and the measures applied. A baseline assessment of the platform is complete and is reviewed annually.
Because we are a processor, the obligation to carry out a Data Protection Impact Assessment rests with our customer as controller. Our role is to assist, and our assessments are written to be used directly in yours. On request we provide our description of processing, technical and organisational measures, sub-processor register and locations, retention periods and deletion mechanics.
Where customer data originating in the European Economic Area, the United Kingdom or Switzerland is processed in the United States, that transfer is governed by the Standard Contractual Clauses incorporated into our data processing agreement.