Security at NIIOMA

NIIOMA OS is hosted on Amazon Web Services (AWS), using enterprise-grade cloud infrastructure.

• Compute: containerised services running on AWS ECS/Fargate with auto-scaling.
• Data storage: managed PostgreSQL databases (AWS RDS) with automated backups and point-in-time recovery.
• Caching: AWS ElastiCache (Redis) for session management and real-time data.
• File storage: AWS S3 with server-side encryption enabled for uploaded documents and media.
• Content delivery: AWS CloudFront for efficient delivery of public and appropriately configured content.

Primary customer databases and file-storage origins are hosted in selected UK or EEA AWS regions. NIIOMA may use global content-delivery and network services, including CloudFront, to deliver public or appropriately configured content efficiently. International processing and applicable safeguards are described in our Privacy Policy and Data Processing Agreement.

• In transit: data transmitted between your device and our servers is encrypted using TLS 1.2 or higher. We enforce HTTPS across all endpoints.
• At rest: data stored in our databases, caches and file storage is encrypted using AES-256 or equivalent AWS-managed encryption. Encryption is enabled by default on all managed services we use.
• Backups: database backups are encrypted and stored in a separate AWS region from the primary data.

• Authentication: user passwords are hashed using industry-standard algorithms. We support multi-factor authentication (MFA) for platform accounts.
• Role-based access: NIIOMA OS uses role-based access control (RBAC) with defined permission levels. Users can only access data appropriate to their assigned role.
• Internal access: access to production systems is restricted to authorised personnel, protected by MFA and logged for audit purposes. We follow the principle of least privilege.
• Credential management: API keys and secrets are stored in secure vaults, separated from application source code.

• Secure development: our development process follows secure coding practices, including peer code review, automated security scanning and dependency vulnerability checking.
• Dependency management: third-party libraries and dependencies are monitored for known vulnerabilities using automated scanning tools.
• Input validation: user inputs are validated and sanitised to protect against injection attacks, cross-site scripting (XSS) and other common vulnerabilities.
• Rate limiting: API endpoints are rate-limited to prevent abuse and denial-of-service attacks.
• Web application firewall: we use AWS WAF to protect against common web exploits and bot traffic.

• Monitoring: we use real-time monitoring and alerting across our infrastructure and application layers. Anomalous activity triggers automated alerts for investigation.
• Logging: system and access events are logged and retained for security analysis and audit purposes.
• Threat detection: we use AWS GuardDuty to monitor for malicious activity and unauthorised access attempts.
• Incident response: we maintain a documented incident response process. Where required by applicable data protection law, NIIOMA will notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a reportable personal data breach. Where a breach is likely to result in a high risk to affected individuals, we will also notify those individuals without undue delay.

• Data residency: primary customer databases and file-storage origins are hosted in selected UK or EEA AWS regions.
• Backups: automated daily backups with point-in-time recovery capability. We test backup restoration periodically.
• Data deletion: upon account termination, user data is deleted in accordance with our data retention schedule as set out in our Privacy Policy.
• Sub-processors: we use a limited number of trusted third-party services to operate our platform. Each sub-processor is assessed for security compliance and operates under a data processing agreement. A current list of sub-processors is available in our Privacy Policy.

We are committed to achieving and maintaining recognised security certifications as we scale. Our security programme includes periodic penetration testing by independent security firms and annual review of security policies and procedures. We are working towards SOC 2 Type II certification.

If you discover a security vulnerability in our platform, we encourage responsible disclosure. Please report it to security@niioma.com with as much detail as possible.

We ask that you allow us reasonable time to investigate and address the issue before public disclosure, avoid accessing, modifying or deleting data belonging to other users, and act in good faith to avoid disruption to our services.

We will acknowledge your report within two business days and aim to provide a resolution timeline within five business days.

NIIOMA’s Data Processing Agreement (DPA) applies automatically where NIIOMA processes personal data on a customer’s behalf as a processor. The DPA is incorporated into the NIIOMA OS Platform Terms and covers data processing scope, sub-processor details, security measures, breach notification obligations, data subject rights and audit provisions. The DPA is available through our legal pages or by contacting legal@niioma.com.