Key Information
• Our policy is to never share or sell data to third parties.
• Our processes comply with the "right to be forgotten."
• Application and data storage: DATALOCATION
• Data is encrypted at rest.
• Internet communications are protected by HTTPS.
Single Sign On
• We do not store or manage user passwords
• User are authenticated via one of these providers: Microsoft, Google, Github
What is accessed during login
• Your personal name and email attributes are needed as part of signup and login authentication process
• If registered via Google, Microsoft or Github channels - we ONLY store email and name
• We are implemented the "right to be forgotten" - when user leaves, the email and name are wiped out
What data is stored
• Your name and email are stored are part of account creation process; Name, nickname and avatar can be modified within personal account
• License configuration requires you to supply name and contact details for the payee
• We do not store any payment details. All sensitive information required for billing is handled via © Stripe - at no stage are credit card details stored on, or even sent to, our servers. All credit card data is sent directly to Stripe’s secure servers. Invoices are available through Stripe's client portal
• Other data that you create and control as part of managing Consortium
• Audit of user access against a given consortium
What we do with data
• Your name, nickname and email are stored on your account record; Data is encrypted at rest; You can modify name, nickname and avatar image link
• Our policy is to never share or sell data to any external party
Data Retention and Archival Policy for core Data
• Your name, nickname, email, experiences commentary and meta data are stored for as a long as the account is maintained in the system. There is no automatic archival and there is no account deactivation policy related to lack of activity.
• User can close the account be "forgotten" as per Account cancellation policy (see below). Space related user identifiable information is either deleted or anonymised on account closure. Data related to payments already processed will be securely stored in order to comply with our tax, accounting, and financial reporting obligations. In all cases where we keep data, we do so in accordance with any limitation periods and records retention obligations that are imposed by applicable law.
Data Deletion Requests
• Whilst compliance is facilitated via self-service (see Close Account action in your cabinet), data deletion requests can be lodged directly with our team by contacting us.
• If you need assistance from our team our response commitement is typically within 72 hours.
Encryption, Hosting and Geo Location of Data
• We do not run own physical infrastructure. Instead, we leverage the power and security of Google Cloud Platform
• Application and datastore are hosted in GCP - host region is US-CENTRAL
• Data is encrypted at rest
• Internet communications are secure - https only
People and Access Policy
• User can access data only with specific spaces as per permissions administered by the administrator-role user(s)
• Only authenticated users can access functionality
Backups
• 24 hour backups policy
---
Account cancellation
• Go to your personal cabinet and click on Close Account button
• User can leave the system at any time. Personal name, nickname, account pairing details and email details will be deleted if the account is closed.
• Experiences commentary will be deleted and person identifiable information purged if your space is not in use
• If space is in use by other permitted users, then a clear notification will be provided during the account closure process. You will have opportunity to agree with other users to archive space in entirety or to purge own commentary only.
---
Complince with the right to be fogetten (GDPR and similar)
• We are committed to ensuring protection of all personal information that we hold, and to provide and to protect all such data. We recognise our obligations in updating and expanding this program to meet the requirements of personal online privacy. We are dedicated to safeguarding the personal information under our control and in maintaining a system that meets our obligations under the new regulations. Our practice is summarised here: https://www.neelix.io/info/library?view=rightToBeForgotten
---
Ai security
• Enterprise Security: Azure OpenAi sandbox is used for artificial intelligence assistants in Neelix platform. Read more information here: https://learn.microsoft.com/en-us/azure/foundry/responsible-ai/openai/data-privacy?tabs=azure-portal
• We use standard enterprise configuration and do not customer data or requests for training
• There is possibility to run our platform on-premises with integration to your own Ai capabilities. Contact us for more information.
---
Availability Policy
Account support SLAs
• Triage of major impact queries within 24 hours
• Triage of all other issues within 5 business days
Service objective is to provide 24/7 up time for users in all geographical locations.
Automatic scalability is configured for application services
• Database backup policy is 24 hours
• We monitor sessions performance and data volumes to ensure appropriate configuration and effective design evolution with the aim of zero incidents
---
Security Vulnerability Process
Scope
The following describes how and when we resolve security bugs in our products. It does not describe the complete disclosure or advisory process that we follow.
Security bug fix Service Level Agreement (SLA)
We have defined the following timeframes for fixing security issues in our products:
• Critical severity bugs (CVSS v2 score >= 8, CVSS v3 score >= 9) to be fixed in product within 4 weeks of being reported
• High severity bugs (CVSS v2 score >= 6, CVSS v3 score >= 7) to be fixed in product within 6 weeks of being reported
• Medium severity bugs (CVSS v2 score >= 3, CVSS v3 score >= 4) to be fixed in product within 8 weeks of being reported
Resolution policies
• When a Critical security vulnerability is discovered by us or reported by a third party, following will be undertaken: Issue a new, fixed release for the cloud deployment.
• Non-critical vulnerabilities: When a security issue of a High, Medium or Low severity is discovered, we will include a fix in the next scheduled release.
Monitoring
• We use reqgualr internal security audit to ensure high standards of awareness of threats
• Customer data configuration changes are auditable
• Internal policies include mandatory 2-factor authentication, staged environments with segregated access permissions, client data access is restricted and audited
What is a ‘release’?
• A release is a version number or tag which contains new features or changes to existing features