HomeLegalSecurity
LegalDeployment inside your environment. Encryption, access controls and a traceable record of every action.
01Posture
Controls aligned to ISO 27001, with a SOC 2 Type II programme in progress. Every item below applies to every deployment.
Newron runs in your VPC, on-premise or air-gapped. Customer data is never sent to third-party model APIs, and Newron keeps no copy of it outside your environment. Support access, where you grant it, is scoped, time-bound and logged.
TLS for data in transit and encryption at rest, with keys managed by you through your own KMS where you choose.
Role-based access control, scoped service credentials and just-in-time access for support, all logged.
Every model output and user action is timestamped, sourced and exportable for audit and regulator review.
02Deployment models
The more sensitive the workload, the more isolated we deploy.
Runs inside your AWS, Oracle or Google VPC. Data stays in your account; Newron holds no copy of it.
Deploys into your own data centre for full physical control over data and compute.
Operates with no internet connectivity for the most sensitive government and financial workloads.
03Certifications & programme
Stated precisely, because procurement will check. We do not claim a certification we do not hold.
Our information security management system is built to the standard’s controls. We are not certified against it.
A Type II programme covering security, availability and confidentiality is underway. No report has been issued yet.
Indian data-residency commitments, made in the customer agreement rather than by certification.
04Last reviewed 1 May 2026
Security is part of how we build, not a layer on top. Our practices include code review on every change, dependency and vulnerability scanning in CI, isolated environments for development and production, and regular internal review of access and configuration. Production changes are logged and reversible.
For our own corporate operations (such as hosting our website and email) we use a small set of vetted providers under contract. For customer deployments, Newron runs inside your environment, so there are typically no Newron subprocessors in the data path. A current subprocessor list is available on request and as part of our security pack.
05Responsible disclosure
We welcome reports from security researchers. If you believe you’ve found a vulnerability, please disclose it responsibly: email our security contact with details and steps to reproduce, give us reasonable time to investigate and remediate before any public disclosure, and avoid accessing or modifying data that isn’t yours. We will acknowledge your report, keep you updated, and credit you if you wish once the issue is resolved. Please do not run automated scans against customer deployments.
06Questions
Yes. Under NDA we share our security documentation, including controls, architecture and subprocessor details. Our SOC 2 Type II programme is still in progress, so there is no report to share yet — the pack sets out where the programme stands.
In a standard deployment, no. The system runs inside your environment and we hold no copy of your data. Support access, where granted, is scoped, just-in-time and logged.
Not without an explicit, contracted agreement. Customer data is processed under your instructions and is not used to train shared models.
We scan continuously, patch on a risk-based schedule, and operate a responsible-disclosure process for external reports.
Security
We’ve answered a lot of them. Share your security and procurement requirements and we’ll work through them with your team.