Security
See where Nebula processes information, how access works and what evidence is kept.
Data flow
Each step names the service, purpose and safeguard. The public white paper uses the same view.
Protected path
Five steps, with a safeguard at each boundary.
Access, processing, storage, AI and proof are controlled separately.
Customer boundary
People use authenticated sessions to reach organisation and engagement workspaces.
Nebula application
Server routes apply session, organisation, membership and route-specific access checks.
Managed data services
The providers' current documentation states that their managed database and object-storage services encrypt stored data at rest. Nebula has not retained current account or applicable-contract evidence establishing the deployed boundary, key custody or backup coverage.
Configured AI providers
Redaction applies to configured text fields by default, not necessarily filenames or native PDFs. Provider terms require confirmation.
Proof boundary
Eligible events can produce a Polygon hash and a signed Nebulad payload. Source documents are excluded.
Review paths
01 · Data architecture
Source configuration specifies Sydney for Vercel Functions; deployed region unverified. Records use managed Neon Postgres and documents use Cloudflare R2.
02 · Encryption at rest
The providers' current documentation states that their managed database and object-storage services encrypt stored data at rest. Nebula has not retained current account or applicable-contract evidence establishing the deployed boundary, key custody or backup coverage. Separately, Nebula wraps each user's signing key with AES-256-GCM using a runtime key. Production sessions use signed, encrypted, httpOnly and secure cookies.
03 · Encryption in transit
Application responses set HSTS for two years, including subdomains, and named provider endpoints use HTTPS. Deployed database and provider settings, including negotiated TLS versions, still require verification.
04 · Privacy posture
Nebula removes common identifiers from configured prompt and extracted-text fields before provider processing by default. This covers phone numbers, emails, TFNs, Medicare numbers and driver licence numbers. Public ABNs and ACNs remain. Filenames and native PDF files are not guaranteed to be redacted, and deployment settings can disable this control.
After a 30-day grace period, erasure anonymises the account and selected name copies, disables sign-in, revokes keys and removes notifications. Shared engagement, audit and proof records may remain. Retained canonical proof data can include identifiers and event details.
05 · Who can see what
Signed-in areas require a session. Engagement areas also require party membership. Machine endpoints use their own authentication. Super-admin access passes a separate gate. When Nebula staff enter an organisation's work through support access, Nebula records the acting identity, stated reason, organisation, each engagement reached, and the start and end. The affected organisation can review that read-only record in its account.
Password accounts support TOTP multi-factor authentication with single-use recovery codes, and an organisation can require MFA for its members.
06 · Account protection
Password sign-in is rate-limited. Users can enable TOTP multi-factor authentication with single-use recovery codes, and an organisation can require MFA for password accounts.
07 · Audit trail
After an API request passes or fails the shared authentication gate, Nebula attempts to record the caller, route, method, decision, user agent and salted IP hash. A 90-day pruning path is configured, but its production execution has not been verified. Recorded engagement changes and selected exports have separate audit paths.
08 · Classified material
Nebula records and displays four Australian Government classification labels: UNCLASSIFIED, OFFICIAL, OFFICIAL: SENSITIVE and PROTECTED. Labels keep handling requirements visible. Access follows assigned roles, while personnel clearances and handling authority remain part of the customer's approved process.
Before material above UNCLASSIFIED enters an environment, Nebula maps the applicable handling requirements and authority with the customer. A higher-classification deployment follows customer-specific control selection, independent assessment and formal authorisation before use.
09 · Document reading
Each reading uses an available provider and the model selected for that session. Nebula removes common identifiers from configured prompt and extracted-text fields by default, but filenames and native PDF files are not guaranteed to be redacted. Nebula's policy excludes customer content from model training. Provider terms and the deployed redaction setting must be confirmed for each customer scope.
10 · Frameworks and posture
SOC 2 is an independent CPA examination and report on controls relevant to security, availability, processing integrity, confidentiality and privacy. Nebula maps its control design and evidence to the AICPA Trust Services Criteria used for that examination.
The Australian Government Information Security Manual is the Australian Signals Directorate's risk-based framework for protecting systems and data. Nebula uses it to organise its control and data-handling matrix. IRAP is the assessment pathway for an ASD-endorsed assessor to review an agreed system boundary against applicable ISM controls. Where procurement requires that evidence, the customer agrees the deployment scope, assessor and authorisation decision.
The white paper
The public paper covers authority, architecture, service regions, AI data flows, proof, standards and procurement review.
The white paper
The public paper covers authority, architecture, service regions, AI data flows, proof, standards and procurement review.
Receive the public paper by email
Use the form for an emailed copy. The cover opens the same paper.
Common questions
First questions, answered from these boundaries.
Source code specifies Sydney for Vercel Functions; deployment unverified. The providers' current documentation states that their managed database and object-storage services encrypt stored data at rest. Nebula has not retained current account or applicable-contract evidence establishing the deployed boundary, key custody or backup coverage. Reading providers may process data outside Australia; terms determine location.
No certification is claimed. Controls are mapped to the SOC 2 Trust Services Criteria and informed by the Australian Government ISM. IRAP scope, assessor and authorisation are agreed with the customer.
Nebula's product policy excludes customer documents, their contents and private derived information from model training and cross customer patterns. The signed in application carries no advertising or analytics tracking, and public pages use consent gated measurement only. Provider terms require confirmation for the customer scope.
Yes. The white paper and architecture view are public; deployment-specific evidence is agreed during Enterprise review.
Key engagement moments can be anchored by hash. An anchor attests integrity and timing, not the claim's truth; disputed records remain visibly disputed.
Email security@nebulaplatform.com.au. The draft vulnerability disclosure policy sets the proposed scope and handling process.
Security questions and vulnerability reports: security@nebulaplatform.com.au. Review the draft vulnerability disclosure policy, or review the maintained subprocessor evidence register.
