Compliance

Zero Data Persistence

PII is processed in-memory only. Original values are never written to disk, logs, or any persistent storage. This is our core design principle that enables compliance with the strictest data handling requirements.

Encryption in Transit

All data is encrypted using TLS 1.3 between your application, NeuronEdge, and LLM providers. We enforce HTTPS for all API connections.

Encryption at Rest

Configuration data, API keys (hashed with bcrypt), and audit metadata are encrypted at rest using AES-256 on SOC 2 certified infrastructure.

API Key Security

API keys are hashed using bcrypt before storage. We never store plaintext keys. Keys can be revoked instantly and are scoped to organizations.

NeuronEdge infrastructure runs on SOC 2 Type II certified platforms (Cloudflare, Neon). We maintain security controls for:

• • Security - Protection against unauthorized access
• • Availability - System uptime and performance
• • Confidentiality - Protection of confidential information

NeuronEdge supports GDPR compliance through:

• • Data Processing Agreement (DPA) for all customers
• • Standard Contractual Clauses for international transfers
• • Article 28 compliant processor agreements
• • Data minimization - we only process what's necessary
• • Right to erasure - account deletion within 30 days
• • Zero PII persistence - no GDPR data stored

For healthcare customers handling Protected Health Information (PHI):

• • Business Associate Agreement (BAA) available for Enterprise
• • PHI detection entities (MEDICAL_RECORD, HEALTH_PLAN, NPI, etc.)
• • Zero PHI persistence architecture
• • Audit logging with configurable retention
• • Infrastructure on HIPAA-eligible platforms

California Consumer Privacy Act compliance:

• • We are a "Service Provider" under CCPA
• • We do not sell personal information
• • Consumer deletion requests honored
• • Transparent data practices in Privacy Policy

What We Log

• • Request metadata (timestamps, endpoints, response codes)
• • Entity types detected (counts only, never actual values)
• • Detection latency metrics
• • Policy and configuration changes

What We Never Log

• • Actual PII values (names, SSNs, emails, etc.)
• • Message content
• • LLM responses
• • Provider API keys

Retention Periods

• • Starter: 7 days
• • Professional: 30 days
• • Enterprise: 90 days (configurable)