We handle sensitive regulatory documents every day. Security is not a feature — it is the foundation every other capability is built on.
Core controls built into every layer of the platform.
All data is encrypted at rest (AES-256) and in transit (TLS 1.3). Encryption keys are managed per-tenant and rotated regularly.
Every organisation operates in a fully isolated data environment. Your documents, answers, and compliance data are never shared with or visible to other tenants.
Role-based access control (RBAC) at every layer. SSO via SAML 2.0 and OIDC, MFA enforcement, and fine-grained permissions for teams and documents.
Every action — document upload, answer generation, export, user login — is logged with a tamper-evident audit trail. Logs are retained for a minimum of 12 months.
Hosted on AWS in SOC 2-compliant regions. Infrastructure is managed with least-privilege IAM, private VPCs, and automated vulnerability scanning.
Automated daily backups with point-in-time recovery. RTO < 4 hours, RPO < 1 hour. Backup integrity is tested on a scheduled basis.
How we handle your data in the context of AI processing.
Documents, questionnaires, and answers you upload are used solely to serve your requests. They are never used to train, fine-tune, or improve any AI model — ours or a third party's.
Where we use third-party LLM APIs, we operate under zero-retention agreements. Prompts and completions are not logged or retained by the provider.
Enterprise customers can deploy neuordo entirely within their own cloud environment or on-premises infrastructure, so data never leaves your perimeter.
Every AI-generated answer includes a source trace — showing which document or knowledge base entry it was drawn from, so you can verify and audit every output.
Our current certification status.
SOC 2 Type II
In progressISO 27001
PlannedGDPR compliant
LiveCCPA compliant
LiveWe take security vulnerabilities seriously. If you discover a security issue, please report it responsibly before disclosing it publicly. We commit to acknowledging your report within 48 hours and resolving critical issues within 14 days.
[email protected]Our team is happy to walk through our security posture, share documentation, or complete your vendor security assessment.
