Security at NuralNest

System overview

Every request follows the same path: encrypted from your device, your identity verified, and your Nest opened only after that check passes.

Where your data lives

All NuralNest data is stored on cloud infrastructure located in the United States. We do not replicate or back up your data outside the US.

Each group gets its own dedicated storage area:

• Isolated storage scoped to that group alone — not a shared pool
• A dedicated, private semantic-search index for that group's documents
• An encrypted metadata record stored alongside it

Storage areas are named with a random per-group identifier, never your email or name. There is no shared "everything" store — by design, code paths that read across groups do not exist.

Encryption

In transit

• Every connection uses TLS 1.2 or higher.
• Requests are automatically upgraded to HTTPS; cleartext connections are refused.

At rest

• Documents and metadata are encrypted at rest with keys we manage in AWS KMS, rotated automatically.
• Documents and account details are protected by separate keys, so the key that unlocks your files is not the key that unlocks your account.
• Isolation is physical, not just logical. Each group has its own storage and its own search index — there is no shared store to filter. A query for one group cannot reach another's data because that data lives somewhere else entirely.

Tenant isolation

Multi-tenant systems most often leak by accident — a query forgets its filter, a path resolves the wrong way. NuralNest is built so the easy path is the safe path:

• Your group identifier is read from your authenticated session on every request. It cannot be passed in a URL, query string, or request body.
• Each group has its own storage and its own search index; there is no cross-group store to confuse.
• Links that open a document expire minutes after they are issued.
• Files are stored under randomized identifiers and are never accessed by filename — even internal logs cannot reveal what you uploaded.

Defense in depth

Each layer is enforced independently — a failure in one does not remove the checks in the next.

Access controls

• Least privilege: every backend component runs with the minimum permissions it needs, and nothing more.
• Our staff do not access your documents. Operational dashboards show request counts and error rates only — never document text or chat content.
• Every access is recorded. Reads and writes against a group's storage are written to an immutable audit trail, so access can always be reconstructed after the fact.
• Audit logs: every meaningful action (sign-in, upload, document read, chat) is recorded in append-only storage, retained up to six years.
• Multi-factor authentication is required for every internal account.

Authentication

• Sign in with passkeys or Face ID. Passwords, when used, are hashed by a managed identity service — we never see them.
• Sessions use short-lived signed tokens with automatic refresh, held in the device's secure storage.
• You can sign out of all devices at any time from Settings → Sessions.

Subprocessors

NuralNest is built on a small set of carefully chosen vendors. Each is bound by a written agreement that restricts use of your data to providing service to us, and none may use it for their own purposes. We do not sell or rent your data to any of them. This is the full list of third parties involved in any feature.

As the service grows we may add subprocessors for features like calendar and email integration. Any addition will be reflected here in advance.

HIPAA

NuralNest is on the path to becoming HIPAA-eligible. The technical safeguards the HIPAA Security Rule calls for — encryption in transit and at rest, per-group isolation, least-privilege access, and audit logging — are already in place, and a Business Associate Agreement with our cloud provider is signed.

We are completing the remaining administrative steps before NuralNest can act as a Business Associate of a covered entity. Until we publish a HIPAA-readiness statement here, NuralNest is intended for personal and group use. If you are a healthcare provider, payer, or clearinghouse, please do not upload PHI until that statement is published.

What we never do

• We never sell, rent, or share your personal information for advertising, analytics, or training data. The only vendors that touch your data are the subprocessors listed above, each contractually prohibited from using it for their own purposes.
• We never use your documents or chats to train AI models — ours or anyone else's. The assistant retrieves from your Nest's own index at query time and reads only the excerpts it needs to answer, retaining nothing afterward.
• We never keep your original file names; documents are stored under randomized identifiers.
• We never copy sensitive details (such as medical information) out of a document into profiles or summaries.
• We never show ads or share data with ad networks or data brokers.
• Our team never browses your documents as part of routine operations.

Your data, your control

• Choose who sees each document — keep it to yourself, share it with your whole Nest, or pick specific members, one document at a time.
• Only the owner decides. The person who added a document is the only one who can change how it's shared — no override, not even by a group admin.
• A record you can undo. Decisions about your books and documents are kept as a history you can review and reverse.
• Export anytime. Ask for a full copy of your documents and information whenever you like. Leaving is always your choice.

Vulnerability reporting

If you believe you've found a security issue, we want to hear from you. Email security@nuralnest.com with a description of the issue and its potential impact, steps to reproduce if possible, and how to reach you.

We'll acknowledge receipt within two business days and keep you informed as we investigate. We don't currently run a paid bug-bounty program, but with your permission we publicly credit researchers who report valid issues. Please give us a reasonable window to fix an issue before any public disclosure, and avoid accessing data that isn't yours — we won't pursue legal action against good-faith research conducted under this policy.

Incident notification

If we ever experience a security incident involving your personal information, we will notify affected users without undue delay and within the timelines required by law. The notice will describe what happened, what information was involved, what we've done, and what you can do.

Where we are today

NuralNest is in private beta. Everything described on this page is built and tested today, and each control is re-verified in our production environment before it holds any customer's documents. We publish this before launch rather than after because it is easier to hold us to it that way.

Updates to this page

Security practices evolve. Material changes to encryption, subprocessors, or access controls will be reflected here, and the "Last updated" date at the top will move forward. For broader changes to how we handle personal information, see the Privacy Policy.

Contact

Security questions or reports: security@nuralnest.com
Privacy questions or requests: privacy@nuralnest.com

United Dream Homes LLC
2300 Olympia Dr. #271761
Flower Mound, TX 75027, USA