The review, answered.
What we run, what we hold, what we do not. Provider named where it applies.
The short version
HELD TODAY
- TLS on every page and form.
- Managed hosting on Vercel; managed Postgres on Neon.
- Role-based access in the client portal — owner, admin, member.
- A written scope and change control on every engagement.
- Accessibility and link checks that fail a release.
- A public build log.
AT CONTRACT
- Your data processing addendum, signed — yours, or the template published at /dpa.
- Security questionnaire answers.
- Architecture diagram and subprocessor list.
- A security contact for the life of the engagement.
- Insurance requirements raised before signature — we do not hold a policy today.
NOT HELD
- SOC 2.
- ISO 27001.
- An insurance policy.
- A standard MSA or SLA.
- A third-party client reference list.
- A staffed operations centre.
- A dedicated security department.
A small studio. That list is the honest one.
Where your data lives
Briefs, messages and files
Neon Postgres; role-based portal access.
Payments
Stripe. Build deposits run through the client's own account; plan purchases run through Nimos Websites' Stripe account. Card numbers never reach us.
Resend for transactional mail.
Hosting and analytics
Vercel, aggregate analytics.
Commerce
Shopify where a build sells; client's store.
Project-specific list
Named in the signed data terms.
ACCESS
Builder only. Client roles: owner, admin, member. Credentials handed over at the end.
RELIABILITY & INCIDENTS
Provider commitments. One-business-day acknowledgement. Status page live.
THE DOCUMENTS
Accessibility, the vendor pack, the legal summary and privacy — all public. The three long-form documents behind this page are public too: the security answer, the subprocessor list and the processing agreement.
Security →Subprocessors →Data processing agreement →Accessibility →Procurement pack →Legal →Privacy →