Security and data protection.
You share your most sensitive documents with us. One NED founder spent his career handling confidential transaction materials inside a major US bank; the other built enterprise SaaS with a focus on security. NED is built to the same standard.
The platforms we use, the data we accept, and the controls in place. A more detailed security summary is available upon request — contact us.
On This Page
Security Summary
A printable summary of NED’s security practices for your compliance, legal, or IT team. A more detailed summary is available upon request.
Download the security summary →Platforms and infrastructure
NED runs on independently certified cloud platforms and maintains no server infrastructure of its own. Client data flows through three: AI assistance, document storage, and business email — the latter two under commercial business terms with a Data Processing Agreement.
AI analysis
NED uses a leading AI assistant provided by a company that holds organizational SOC 2 Type II, ISO 27001:2022, and ISO/IEC 42001:2023 certifications. ISO/IEC 42001 is the international standard for AI management systems and provides independent assurance of the provider’s governance of AI model development and operation.
Subscription tier and training
Model training is disabled in NED’s account, so client documents and conversations never train an AI model. Conversation data is retained by the provider for roughly 30 days for trust and safety review, then deleted.
This tier carries no flow-through Data Processing Agreement, BAA, or zero-data-retention addendum. Clients needing those — banks under regulator oversight, organizations with GDPR processor obligations — should raise it before the engagement starts so we can arrange appropriate terms.
How we use AI
AI assists with document review, analysis, drafting, and research. Every output is verified by a qualified NED principal before delivery.
Workspace isolation
Each engagement gets a dedicated, isolated workspace. Your documents and conversations are not visible to any other engagement.
Encryption
All data submitted to the AI platform is encrypted in transit and at rest on the provider’s infrastructure.
Document storage and sharing
Document storage runs on an enterprise content management platform used by regulated financial institutions, healthcare organizations, and government agencies, under commercial terms with a Data Processing Agreement.
Encryption
All files are encrypted at rest using AES 256-bit encryption and in transit using modern TLS. The platform applies an additional cryptographic key-wrapping layer to the encryption keys themselves. Cryptographic modules are FIPS 140-2 certified, confirming they meet federal standards.
Access controls
The platform operates on a zero-trust architecture with single sign-on (SSO), multi-factor authentication (MFA), and role-based access controls. NED configures folder-level permissions per engagement.
Compliance certifications
The platform holds certifications including SOC 1, SOC 2, ISO 27001, HIPAA, FedRAMP, PCI DSS, and FINRA SEC 17a-4. Files are replicated automatically to a backup facility at time of upload, with active-active data center redundancy and point-in-time recovery.
Business email
NED’s email is hosted on a major cloud productivity platform on a business subscription tier with a Data Processing Agreement in place. All email accounts are protected by multi-factor authentication.
Encryption
Internal messages are encrypted automatically. Enterprise-grade encryption for external recipients is available on request, accessible only via secure link to verified recipients.
Threat protection
Mail passes through enterprise threat protection: anti-phishing, attachment scanning, spoofing quarantine, and spam filtering. Tenant baselines enforce MFA and block legacy authentication.
Compliance
The platform maintains compliance certifications including SOC 1, SOC 2, ISO 27001, HIPAA, and GDPR.
NIST data classification — what we accept
NED aligns its data handling with the four-level commercial data classification framework consistent with NIST data classification guidance ↗ (NIST SP 800-53, NIST IR 8496). For all of NED’s engagements — across M&A and project finance, independent engineering, tax credit transfers, owner engineering, equipment assessment, software development, and marketing support — the relevant materials fall squarely within Level 2 (Internal / Sensitive) and are well within NED’s security posture. The levels below describe what NED accepts and does not accept.
Level 1 — Public
Information freely available or intended for public disclosure. No special handling required. Examples: press releases, published research, public project announcements, marketing materials, regulatory filings available on EDGAR or FERC.
✓ NED accepts Public data.
Level 2 — Internal / Sensitive
Non-public business information whose disclosure would cause limited harm but which is not subject to legal or contractual restriction. Requires reasonable access controls and standard confidentiality practices. Examples: draft due diligence reports, non-final term sheets, pre-NDA project summaries, general financial projections, IE reports shared under NDA, transaction timelines, non-sensitive correspondence.
✓ NED accepts Internal / Sensitive data — the most common category in our engagements.
Level 3 — Confidential
Information that is legally, regulatorily, or contractually restricted from unauthorized disclosure. Breach could cause significant financial, legal, or reputational harm. Requires strong access controls, encryption, and formal data handling agreements. Examples: personally identifiable information (PII), personally identifiable financial information (PIFI), Social Security numbers, tax identification numbers, bank account details, HIPAA-protected health information, payment card data (PCI DSS), attorney-client privileged communications, information subject to SEC Regulation FD, classified government information.
× NED does not accept Confidential data as defined above. If you believe your engagement requires handling of Confidential data, please contact us to discuss a customized arrangement.
Level 4 — Restricted
The most sensitive category — information whose unauthorized disclosure could cause severe or catastrophic harm, trigger criminal liability, or compromise national security. Access limited to a small number of specifically authorized individuals. Examples: classified national security information, Top Secret government data, trade secrets protected under the Defend Trade Secrets Act, cryptographic keys and authentication credentials, information whose disclosure is prohibited by court order or consent decree.
× NED does not accept Restricted data under any circumstances.
Regulated organizations and special handling
Banks under OCC, FDIC, Federal Reserve, or FINRA oversight, and organizations subject to GDPR, can request more advanced data security.
Where special handling is required for your engagement, it will be documented explicitly in your scope of work or engagement letter. Contact us to discuss your requirements before sharing any materials.
NIST SP 800-53 controls we apply
NED applies the following security controls consistent with NIST Special Publication 800-53 Rev. 5 ↗. The controls listed below apply across NED’s three platform categories — AI assistance, document storage, and business email — and to NED’s operational practices for session management, authentication, and access. NED never stores client data on laptops or local devices. All client materials reside exclusively on the encrypted cloud platforms described above.
Multi-factor authentication — NIST SP 800-53 IA-2
MFA is enforced on every account using phishing-resistant methods per NIST SP 800-63B. Tenant baselines block legacy authentication.
Session lock — NIST SP 800-53 AC-11
Devices lock automatically on inactivity. Client data is never stored locally, so a locked device exposes nothing — each platform requires separate re-authentication with MFA.
Password management — NIST SP 800-53 IA-5
Passwords are never reused across services. Password complexity and length requirements meet or exceed NIST SP 800-63B guidelines.
Encryption in transit and at rest — NIST SP 800-53 SC-8, SC-28
Client data is encrypted in transit (TLS) and at rest (AES-256) natively on all three platforms. Nothing is transmitted over unencrypted channels.
Login attempt controls — NIST SP 800-53 AC-7
All NED platform accounts are configured to lock or alert after a threshold of unsuccessful login attempts, limiting the risk of brute-force credential attacks.
Data backup — NIST SP 800-53 CP-9
Documents replicate to a backup facility on upload, with active-active data center redundancy and rollback to the last uncorrupted version after ransomware or accidental deletion. NED holds no local copies.
Data retention
Unless directed otherwise by the client, NED retains client materials — including deliverables, work product, engagement records, and client-provided source materials — in a secure, access-controlled archive for a minimum of seven years from the conclusion of the engagement. This practice serves two purposes: it allows NED to retrieve materials quickly on your behalf if needed for future reference, litigation support, regulatory inquiry, or follow-on work; and it conforms to standard professional services data retention practices consistent with applicable statutes of limitations and recordkeeping norms.
Archives sit in a restricted area of the same platform, under the same controls described above.