Legal
We operate NUL Systems according to four principles:
NUL Systems is hosted on Fly.io, which maintains world-class physical and network security, including SOC 2 Type II, ISO 27001, and other industry-standard certifications. Our infrastructure is hosted in the US-East region (Ashburn, Virginia).
We use modern infrastructure practices including container orchestration, infrastructure-as-code, and automated deployment pipelines. Network traffic is isolated using virtual private networks and security groups, and access to production infrastructure is limited to authorized engineers through multi-factor authentication.
All data transmitted between your browser, our APIs, and our infrastructure is encrypted in transit using TLS 1.2 or higher. We enforce HTTPS across all endpoints and do not support insecure protocols.
Customer Data stored in our systems, including databases, object storage, and backups, is encrypted at rest using AES-256 encryption. Encryption keys are managed by each infrastructure provider's key management service (KMS) with strict access controls; we do not layer application-level encryption on top.
User passwords are never stored in plaintext. We hash passwords using industry-standard algorithms (bcrypt or equivalent) with unique salts. API keys and secrets are stored in dedicated secret management systems.
NUL Systems is a multi-tenant SaaS platform operating on a shared-database, shared-schema model. Customer Data is logically isolated by organization_id scoping enforced in the application and authentication layers: every authenticated request is bound to the caller's organization via a signed JWT, and every tenant-scoped query filters on that organization ID. We additionally use Postgres Row-Level Security as a defense-in-depth control at the database layer.
Access to Customer Data by our own team is limited, logged, and auditable.
Customer accounts require a verified email address. We support strong passwords and plan to offer single sign-on (SSO) and multi-factor authentication (MFA) as the Service matures. Session tokens expire after a period of inactivity.
Access to production systems, customer data, and sensitive infrastructure is restricted to authorized personnel on a least-privilege basis. All internal access requires multi-factor authentication and is logged for audit purposes. We do not access Customer Data except as necessary to provide support or investigate an operational issue, and only with appropriate authorization.
Backups of Customer Data are managed by our infrastructure providers. Our managed Postgres performs continuous write-ahead log (WAL) archival and daily snapshots; our managed graph database (Neo4j Aura) performs daily snapshots. Backups are encrypted and stored in a region separate from the primary. We maintain a disaster recovery plan with defined recovery time and recovery point objectives, and we will conduct and document our first end-to-end restore drill before general availability.
We continuously monitor our infrastructure and application for availability, performance, and security signals. This includes:
We maintain an incident response plan covering detection, triage, containment, eradication, recovery, and post-incident review. In the event of a security incident affecting your data, we will notify you without undue delay and in accordance with applicable law.
We follow modern secure software development practices:
We use a limited set of trusted third-party service providers ("subprocessors") to operate NUL Systems. Each subprocessor is evaluated for security and contractually bound to appropriate data protection commitments. Our current subprocessors include:
We update this list as our service providers change. Material changes will be communicated to active customers.
Our compliance roadmap:
Security is a shared responsibility. We protect the Service and your data at the infrastructure and application level. You are responsible for:
We welcome reports from security researchers and the broader community. If you believe you have discovered a security vulnerability in NUL Systems, please report it responsibly.
Contact: security@delphiinsights.us
We ask that you give us a reasonable time to investigate and remediate before public disclosure. We will acknowledge your report promptly and keep you informed of our progress. We do not currently operate a paid bug bounty program, but we recognize researchers who report in good faith.
We believe transparency is the foundation of trust. If you are evaluating NUL Systems and need more detail on any of the above for a vendor security review, procurement process, or internal risk assessment, we are happy to help.
Delphi Insights, LLC
Security inquiries: security@delphiinsights.us
General contact: info@delphiinsights.us
End of Security & Trust Page
