How Nubesti treats authorization, data, and platform security.

Production marketing and application traffic is served over TLS through Cloudflare. Legal documents describe encryption in transit, encryption at rest where we control the store, unique administrative identities with MFA, role-based access in the product, and security-relevant logging.

Details that belong in a CISO review: Platform security. Binding language: Security overview.

Account, billing, website, and support data are handled as described in the Privacy Policy. When we process customer personal data as a processor, the DPA applies. Current subprocessors: Subprocessors. Cookie use: Cookie Policy.

Privacy requests: [email protected] · [email protected].

Report vulnerabilities in Nubesti systems (not customer targets) under the Vulnerability Disclosure Policy. Email [email protected]. Canonical researcher file: /.well-known/security.txt.

Paid access and test launches require KYC. Tests run only against assets the customer authorizes and owns or has written permission to test. Rules of Engagement, an authorization letter, and an acceptable-use policy apply. You can stop in-progress jobs from the portal.

See KYC, Authorization, Rules of Engagement, and Acceptable Use.

Nubesti is not presenting SOC 2, ISO 27001, PCI DSS, HIPAA, or FedRAMP as current certifications. Controls are described in legal documents so customers can map them to their programs. Formal reports, if they exist later, will be stated exactly and dated.