Security Policy - NistCheck

1. Secure Infrastructure

• Cloud Hosting: NistCheck is built and hosted in Microsoft Azure, leveraging its advanced security features.
• Architecture: Our environment follows modern security architecture principles, including modular security components, least-privilege access, encryption, secure by design, secure by default, defense in depth, continuous logging and monitoring, privacy by design, regular independent security testing, and continuous compliance monitoring.

2. Monitoring and Protection

• We use security monitoring tools to detect and respond to suspicious activity.
• Logs and alerts are reviewed regularly to maintain system integrity and reduce risk.

3. Secure Development Practices

• All code is developed in alignment with the OWASP Top 10 and secure coding guidelines.
• Peer review, automated security scanning, and dependency management are part of our development lifecycle.
• Security updates and patches are applied promptly.

4. Testing and Assurance

• Regular Testing: Our platform undergoes frequent vulnerability assessments and security testing to ensure resilience against evolving threats.
• Penetration Testing: Independent penetration tests are conducted regularly, and an overview of recent results can be provided to customers upon request.

5. Compliance and Certifications

NistCheck aligns with leading security standards and frameworks, including:

• PCI DSS – We have completed Payment Card Industry Data Security Standard requirements.
• CSA STAR – We have conducted a Cloud Security Alliance STAR assessment.
• Best Practices – We utilise the NIST Cybersecurity Framework in addition to the NIST Special Publication (SP) standards.

6. Customer Data Protection

• All customer data is encrypted in transit (TLS 1.2+).
• Access to customer data is strictly controlled, logged, and limited to authorised personnel. Access to customer data is only allowed if a customer requests assistance and access to their data is required to provide it.
• We do not share customer information with third parties except where legally required.

7. Commitment to Continuous Improvement

Cybersecurity is an evolving discipline. We continuously review, update, and enhance our security practices in line with industry developments, regulatory requirements, and customer expectations.

8. Contact

For security-related questions, penetration test summaries or compliance documentation, please contact us at:

9. Reporting a Vulnerability

If you believe you have found a security vulnerability in NistCheck, please report it to [email protected] with enough detail for us to reproduce the issue.

We endeavour to acknowledge initial reports within 2 weeks.

We do not offer monetary rewards or bug bounties for vulnerability disclosures. We are grateful for reports made in good faith.

In scope

• nistcheck.com
• app.nistcheck.com
• api.nistcheck.com

Out of scope

• Denial of service, load or stress testing, and any volumetric technique.
• Social engineering or phishing of our staff or customers.
• Physical attacks against offices or personnel.
• Third-party services we do not operate, including Stripe, Microsoft Azure, and the Google and Microsoft identity providers. Please report those to the vendor directly.
• Staging and development environments.
• Automated scanner output with no demonstrated impact, including missing security headers, cookie flags, TLS configuration, and software version disclosure.
• SPF, DKIM, and DMARC findings without a working exploit.
• Issues requiring a rooted, compromised, or physically accessed device.

When testing, please

• Use your own account or test data. Do not access, modify, or delete data belonging to other customers.
• Avoid any action that degrades service for others.
• Give us reasonable time to remediate before disclosing publicly.