TRUST CENTER
Security
Clear information about NintyOS, your choices and the planned platform.
Initial policy draft for review. NintyOS is in development. These provisions must be verified against actual operations and professionally reviewed before publication.
Security begins with scope
NintyOS is in development. This page describes intended practices and the public-site security approach that must be verified on the deployed host. It does not claim SOC 2, ISO 27001, HIPAA, PCI or any other certification.
Transport and access
The deployed site should enforce HTTPS, keep software current and restrict administrative access to people who need it. Strong authentication and appropriate login protection are deployment requirements.
Least-privilege integrations
Future connections should request only permissions required for enabled features. Tokens belong in the separate application infrastructure, protected from public page code and contact submissions.
Human approvals
The planned product includes scoped recommendations and approval controls. Auto Execute is a proposed opt-in mode, not an active capability. Released controls need testing against the actual permissions model.
Data protection and recovery
Backups, administrative access, mail handling and log retention must be configured and tested on hosting. Application data protection and recovery require a separate design and verification.
Monitoring and incidents
Operational monitoring and a documented incident response process should be in place before launch. Any notifications must follow applicable obligations and the verified facts of the incident.
Reporting a concern
Email support@nintyos.com with a description of the issue, affected URL and safe reproduction details. Do not exploit a finding further, access other users’ information or include secrets in the report. This page does not authorize penetration testing.