Trust
Incident response
How PastePile Labs LLC handles a security incident affecting NEMUQU or the data customers keep in it, and how customers are told.
On this page
Detection
- An automated check runs every ten minutes against the API, the database, the analysis pipeline, the job cache and the report renderer, and alerts the operator when one fails. It runs with the same hosting provider, so a provider-wide suspension can stop the check as well; that happened in the October 2026 outage.
- Application and access logs are kept by the hosting provider. Authentication events, including failed sign-ins, are recorded in a security log and in each organization's audit history.
- Reports from customers and researchers arrive at security@nemuqu.com.
Triage and containment
A report is first confirmed or ruled out. If it is real, the first goal is to stop further exposure: revoke sessions or credentials, rotate keys, disable an affected feature or take a component offline. Evidence about the incident is preserved before systems are changed where that is possible.
Investigation and remediation
The investigation establishes what happened, which data and organizations were affected, and the cause. The fix is deployed and verified, and what could not be determined is recorded as such rather than guessed.
Telling customers
- If an incident affects your organization's data, its owners are notified by email without undue delay, with what is known, what is not yet known, and what you may need to do.
- Updates follow as the investigation establishes more.
- Service disruptions are published on Service status, including after they are resolved.
- Customers with a signed Data Processing Addendum are notified under its terms, at the security contact they designated.
Your obligations
If personal data you control is involved, you decide on any notice to regulators or individuals. We give you the information we have and help you meet your deadlines.
Afterward
After an incident, its cause and the change made in response are recorded. Incidents that affected the service stay on the status page with their full update history; notes are corrected in the open, not rewritten.
Last updated .