This page describes our technical and organisational security measures under NIS2 Art. 21(2) and Art. 32 GDPR. It is a summary — the full security documentation is available to customers under NDA.

Data protection

Encryption at rest — Supabase PostgreSQL with AES-256 (EU Frankfurt).
Encryption in transit — TLS 1.3 with HSTS for every public endpoint.
PII encryption — specific sensitive fields (lead contact emails, license assignments, etc.) are encrypted per-row via the Supabase Vault key.
Backups — the database is backed up by Supabase; the application is restored from versioned Docker images.
Tenant isolation — Row Level Security on Supabase for per-tenant segregation; service-role keys are used server-side only.

Access and authentication

Multi-factor authentication (TOTP) for all user accounts, enforced for admin roles.
HIBP password check, strength meter, brute-force lockout and rate-limited login and registration.
CSRF + anti-CSRF tokens on state-changing endpoints plus Cloudflare Turnstile on public forms.
RBAC roles (owner / admin / member) with an audited change log.
Session management with revocation and notifications for password changes.

Application security

Next.js 16 with strict CSP headers (connect-src, frame-ancestors 'none', base-uri 'self').
Dependency audit via GitHub Dependabot + Snyk in the CI pipeline.
Sentry error monitoring with PII scrubbing (no secrets in stack traces).
Secrets are stored as environment variables on the production server, outside the code repository.

Sub-processors and Schrems II

The full sub-processor list with location, purpose and transfer mechanism is available at /sub-processors. Transfers to US sub-processors rely on Standard Contractual Clauses (SCCs) under Commission Decision 2021/914, incorporated in their DPAs. Customers receive e-mail notification at least 30 days before any sub-processor change (Art. 28(2) GDPR).

Reporting security vulnerabilities

If you have found a vulnerability, please let us know. We will not take legal action against security researchers who follow the rules below (safe harbor).

Contact

security@nismap.com

We acknowledge receipt within 3 working days and give a status update within 10 days.

In scope

nismap.com and all subdomains (except staging.*)
API endpoints under /api/* including WebSocket and server-sent events
Client-side code (React/Next.js) and server-side rendering
PDF generator (@react-pdf/renderer on the server)

Out of scope

DoS / DDoS — unstructured load testing cannot be distinguished from an attack
Social engineering targeting Inger s.r.o. staff or auditors
Vulnerabilities in third-party code (Supabase, Hetzner, Cloudflare — report directly to the vendor)
Brute-forcing Stripe payment tokens — Stripe has its own bug bounty
Physical attacks against vendor infrastructure
Scraping public data through the rate limiter

Responsible testing rules

Do not test on production customer data — use the sandbox or your own test account
Do not disrupt the service, do not take anything offline, do not exfiltrate data
Do not exploit vulnerabilities beyond what is needed for a proof of concept
Do not share or publish findings with third parties before we have fixed them
Respect the disclosure timeline — 90 days from our acknowledgement by default

Rewards

At this stage we do not offer a monetary bounty — we are a pre-seed project. Every valid report is listed at /security/hall-of-fame (if the reporter wishes) and we are happy to provide a reference to any future employer. For critical vulnerabilities (RCE, ATO, data exfiltration) we can cover at least the researcher's hosting / CI costs.

Platform security at NISMap