1. Scope
This policy describes how Namd is built and what we hold. The service is a web application hosted on Vercel, a Postgres database on Neon, and transactional email through Resend. The personal data in it is an email address given so a report can be sent, and a hashed IP address used to enforce the scan rate limit.
2. Infrastructure
- The application and the scan endpoint run on Vercel
- The database runs on Neon, which encrypts data at rest
- Report email is delivered by Resend
- Traffic to namd.tech is served over TLS
Each of these providers publishes its own certifications and security documentation. Namd holds none of its own. See section 6.
3. Application security
- The scan endpoint is rate limited per caller, so it cannot be turned into a request amplifier pointed at other people's servers
- URLs submitted for scanning are checked before they are fetched, so the scanner cannot be steered at private network addresses
- The scanner reads publicly available pages only. It does not authenticate to anything on your site
- Where we propose changes, they arrive as a pull request you review and merge. We do not write to your repository
4. Data protection
- IP addresses are hashed before storage. We do not store raw addresses
- We store no payment data, because we operate no payment processor
- We store no account credentials, because there are no accounts
- Access to production systems is limited to Namd personnel who need it
5. Incident response
If we become aware of an incident affecting personal data, we investigate it, take what steps we can to contain it, and notify affected people and any customer acting as controller without undue delay.
6. Certifications and compliance
Namd holds no SOC 2 report, no ISO 27001 certificate and no PCI DSS attestation. PCI DSS does not apply to us: we handle no cardholder data. Our infrastructure providers hold their own certifications, which they publish themselves, and which are theirs rather than ours.
We are subject to the GDPR and handle personal data as described in our Privacy Policy and our Data Processing Agreement.
7. Reporting a vulnerability
If you find a security issue, write to hello@namd.tech with enough detail for us to reproduce it. Please give us a chance to fix it before disclosing it publicly, and do not degrade the service or access data belonging to anyone else while testing. We run no bug bounty and offer no payment for reports.
8. Contact
Security questions and vulnerability reports go to hello@namd.tech.