TRUST · SECURITY

Security at Northern Star.

NgineAgent is a stateless, deterministic validation engine. It runs inside your own infrastructure, makes no external calls, and retains no data — the same input always produces the same output and the same score. Encryption, access control, and a full auditable evidence chain apply by default, to the engine and every product built on it.

— PRINCIPLES

Five things we do by default.

No feature flag, no enterprise tier, no opt-in. These apply to the NgineAgent engine and every product built on it, on every plan.

/ 01 — DATA PROTECTION

Encrypt everything, everywhere.

TLS 1.3 in transit for all API and dashboard traffic
AES-256 encryption at rest for catalog data and correction records
Daily encrypted backups with 30-day retention
Customer catalog data is never used to train shared models or sold to third parties

/ 02 — INFRASTRUCTURE

Hardened by default.

NgineAgent runs inside your own infrastructure — no external calls, no data leaving your environment
Managed Linux infrastructure with hardened OS configurations
Network isolation between sandbox and production environments
Automated patching for OS and runtime dependencies

/ 03 — ACCESS CONTROL

Least privilege, always logged.

Least-privilege access for all internal staff
Mandatory MFA on every admin account
Per-customer API tokens scoped to a system and environment
Full audit log of every correction, validation, and access event

/ 04 — INCIDENT RESPONSE

Tested, documented, fast.

24/7 monitoring with automated paging
Documented incident response runbook
Affected customers notified within 24 hours of any confirmed material incident
Post-incident reports published to the Status page

/ 05 — DATA HANDLING

Your data is yours.

NgineAgent is stateless and retains no data — each run produces a deterministic, auditable evidence chain (report → worksheet → corrected master) that stays in your environment
Export your full dataset at any time, in standard formats
Delete on request — corrections, validations, and audit records purged within 30 days of termination
Data residency options available for EU and US customers on Enterprise plans

— COMPLIANCE

Where we stand on certifications.

Honest status — what's done, what's in progress, what's available on request.

In effect

GDPR

EU customer data handled under the GDPR. DPA available on request.

In progress

SOC 2 Type II

Controls implemented; formal audit in planning. Letter of intent available for security reviews.

In effect

HIPAA-aware

MediReady processes healthcare data under HIPAA-aware controls. BAA available.

In effect

DPA on request

Standard data processing agreement available for review and signature before contract.

— RESPONSIBLE DISCLOSURE

Found a vulnerability? Tell us first.

We don't run a public bug bounty yet, but every valid report is acknowledged within 48 hours, triaged, and credited (with your permission) in our security log once fixed.

What to include in your report.

Steps to reproduce. A clear path from start to impact. Screenshots and request traces help.

Impact. What you were able to do or access. We triage based on real-world severity, not CVSS in isolation.

Suggested fix (optional). If you see one. Not required.

Please test only against your own account and sandbox environment. Do not access other customers' data. Do not publish before we've confirmed a fix is shipped.

Send reports to

security@northernstarsystems.com

Acknowledged within 48 hours. PGP key available on request. Critical issues paged 24/7.