Trust
Trust center
What a security or procurement reviewer needs to know about NEMUQU, with the page that supports each answer. NEMUQU is operated by PastePile Labs LLC.
On this page
At a glance
- Certifications
- None held: no SOC 2, ISO 27001 or FedRAMPWhat we do not claim
- Hosting
- United States: database in us-west-2, services in OregonSubprocessors
- AI
- Off unless a member asks; never sees uploaded filesAI use
- Tracking
- No third-party analytics, advertising or cross-site trackingCookies and storage
- Uptime commitment
- None offeredReliability
- Data processing
- Addendum on request, completed per customerData Processing Addendum
Security
Uploaded evidence is treated as hostile input: never executed, hashed on arrival, parsed under limits. Access is enforced per organization in the API; sessions, passwords and provider keys are protected as described on the security page, which also lists what is not claimed.
- Security
Controls that exist in the code today, their limits, and what NEMUQU does not claim.
- Report a vulnerability
Where to send a report, what is in scope, how to test, and what happens next.
- Sensitive evidence handling
How uploaded logs, credentials inside evidence and personal data in cases are stored, shared and removed.
Describes practice. Privacy Notice 2026-09-24 governs.
Incidents and reliability
Service health is published from live checks, with operator-written incident updates. Backups exist and a restore has been tested; no recovery time or uptime is promised.
- Incident response
How a security incident affecting NEMUQU is handled and how customers are told.
Describes practice. Privacy Notice 2026-09-24 governs.
- Reliability and backups
Monitoring, backups and recovery that exist and have been tested, with no uptime promise.
Describes practice. Terms of Service 2026-09-23 governs.
Current state: Service status.
Privacy and data protection
- Privacy Notice
What NEMUQU processes, why, where it goes, how long it is kept and how to ask about it.
- Data retention and deletion
How long each kind of record is kept, what deletion removes, and what remains in backups and history.
Describes practice. Privacy Notice 2026-09-24 governs.
- Subprocessors
Every provider that processes customer data, what it receives and which locations are verified.
Describes practice. Privacy Notice 2026-09-24 governs.
- Make a privacy request
Ask for access, correction, deletion or a copy of your data. Requests are verified by email and answered within 30 days.
Describes practice. Privacy Notice 2026-09-24 governs.
Compliance status
- No independent audit, certification or penetration test has been completed. NEMUQU does not hold a SOC 2 report or an ISO 27001 certificate, and does not claim to.
- No authorization to handle classified information, Controlled Unclassified Information or health information under a HIPAA business associate agreement. Do not upload data of those kinds.
- Agreements: the Terms of Service and Privacy Notice in force are listed in the legal center with their versions. A Data Processing Addendum is available on request.
- Policies on this site describe practice. Publishing a policy is not a claim of compliance with any law or framework.
Contacts
- Security vulnerabilities: security@nemuqu.com, under the disclosure policy.
- Privacy requests: the request form, or privacy@nemuqu.com.
- The Data Processing Addendum: privacy@nemuqu.com.
- Security reviews and questionnaires: support@nemuqu.com.
- Billing: billing@nemuqu.com.
- Suspected misuse of NEMUQU: abuse@nemuqu.com.
- Formal legal notices: the postal address in the Terms.
Last updated .