Neurosnap | Security Overview

Last reviewed on October 27th, 2026

Overview

Neurosnap protects customer research data and intellectual property through technical controls, personnel policies, secure development practices, and recovery planning. This overview describes those measures and connects you to our data-handling and incident-response documentation.

Customer data protection

Our confidentiality obligations cover customer data, including proprietary sequences, structures, models, job inputs and outputs, and Agent conversations and files. Customers retain ownership of their content. Neurosnap does not use customer data or outputs to train models, improve algorithms, or develop new services without explicit consent, as described in our Terms of Use.

Enforced TLSv1.3 Encryption: All web traffic is encrypted using the latest TLS standard, ensuring protection during data transmission.
Password Storage: Account passwords are stored as salted Argon2id hashes rather than reversible encrypted passwords.
Key Management: Authentication credentials and key material are encrypted and protected by a robust Key Management System (KMS).
Strong Password Policies: Neurosnap enforces password policies based on industry best practices to ensure account security.

Personal and team resources have different access rules. Review the selected scope before submitting confidential data; team jobs and team Agent conversations are accessible to current members of the associated team. Our sharing and access settings describe the defaults and available sharing features.

Access and personnel security

User Data Access: Neurosnap team members do not have access to user data.
Production Access: Access to production environments is restricted; developers do not have direct access.
Workforce Authentication: Access to Company systems uses multi-factor authentication and authorization based on job responsibilities.
Training and Confidentiality: Personnel receive security, confidentiality, and incident-reporting training. Employees and contractors must review and acknowledge applicable security and compliance policies annually.
Managed Devices: Staff use approved laptops and desktops with device encryption, screen locks, security updates, and appropriate physical safeguards. Staff handling of confidential Company data on mobile devices is prohibited, except for the approved managed Company-email application under our internal device policy.
Secure Transfers: Staff use approved secure channels for confidential information. Sensitive attachments are encrypted, with passwords communicated separately through a secure method.

Secure development and vulnerability management

In-House Development: All software development is done in-house. Hosting, storage, AI processing, and other operational services may use third-party providers listed in our Privacy Policy.
Reviewed Changes: Our development policy requires version-controlled, peer-reviewed changes, security testing, and auditable deployment and change-management processes.
Vulnerability Management: We identify and prioritize vulnerabilities using severity, exploitability, exposure, and business impact. Dependencies and vendor advisories are monitored as part of maintenance.
Remediation and Exceptions: Our patching policy defines remediation timelines by severity. Where immediate patching is not feasible, compensating controls and approved, documented exceptions are required. Emergency changes are documented and reviewed retrospectively.
Regular Security Audits: Audits, as well as source code reviews, are conducted regularly. Tools added to the platform undergo high-fidelity security evaluations.

Infrastructure protection and monitoring

Advanced Firewalls: Industry-standard firewalls and intrusion prevention systems are deployed to protect network boundaries.
Proactive Breach Prevention: Neurosnap uses proactive threat hunting, incident response planning, and regular vulnerability and penetration testing to stay ahead of evolving threats.
Monitoring and Alerting: Security alerts monitor suspicious activity across applications, platforms, and networks. Logs track successful/failed logins and sensitive system changes.
Asset Management: Our asset inventory policy assigns owners to systems and data assets and requires periodic reviews to support access control, vulnerability management, and incident investigations.

Resilience and recovery

Encrypted Data Backups: Backups are encrypted and tested annually to ensure their effectiveness and security.
Disaster Recovery and Business Continuity: Neurosnap maintains a disaster recovery program approved by management, with documented and tested backup procedures.
Recovery Planning: Our continuity procedures define recovery objectives by component and call for annual recovery drills, backup-integrity checks, and incident tabletop exercises.

Retention and deletion depend on the data category and applicable obligations. See our Privacy Policy and the Agent data lifecycle for details about saved conversations, temporary sessions, files, and backups.

Jurisdiction & Data Processing

Neurosnap processes data primarily in the United States, with some processing in Canada and the EU. Only a small percentage of data is handled outside the U.S., and clients may request region-specific processing by contacting our support team. All data is encrypted in transit and at rest wherever reasonably possible.

Third-party processors are listed in our Privacy Policy. All third parties are thoroughly vetted, and exposure of information is limited strictly to a need-to-know basis.

For provider processing, network controls, and the distinction between Neurosnap storage and hosted Agent sessions, see Agent Architecture & Data Handling.

Governance and risk management

ISO 27001 Compliant: Neurosnap aligns its security practices with ISO 27001 standards, including formalized risk assessments, documented security controls, and continuous improvement processes. This ensures a structured and internationally recognized approach to information security management.

Neurosnap has a formalized Enterprise Risk Assessment process and governance plan. These efforts include:

Risk identification through vulnerability scans, threat modeling, and internal feedback.
Quantification and prioritization based on predefined risk acceptance levels and business objectives.
Mitigation strategies including policy updates, technical controls, and corrective actions.
Continuous monitoring and periodic audits to evaluate and refine mitigations.
Ongoing collaboration with external security experts as needed.
Integration of risk management with strategic planning and operational decision-making.
Regular training and internal communication to promote awareness and accountability.

Incident response

Security Incident Response: Neurosnap has a dedicated incident response team, with formalized plans and notification procedures to investigate and respond to breaches.

Our Security Incident Response & Breach Notification Policy explains containment, investigation, recovery, customer communications, and applicable reporting requirements, including incidents affecting confidential research data.

Email Security

Neurosnap adheres to industry-leading practices in email security, leveraging the M3AAWG Sender Best Common Practices Version 3.0 and proprietary enhancements.

SPF and DKIM with DKIM Rotation: Email authentication protocols are enforced with regularly rotated DKIM keys.
DMARC Enforcement: Domain-based authentication helps block spoofed and malicious emails.
DNSSEC Activation: Ensures authenticity of DNS responses and prevents spoofing.
S/MIME for Email Encryption: Used to encrypt and authenticate sensitive outbound communications.
TLS Encryption: All outbound emails use TLS to secure transmissions.
Comprehensive Monitoring: Email traffic is continuously monitored for anomalies and threats.
Email Security Scanning: All email attachments are scanned for threats, such as viruses and malicious code.

Enterprise security review

For security questionnaires, supporting documentation, or requirements involving access controls, data handling, or processing locations, contact hello@neurosnap.ai or our support team. Please identify the Neurosnap features and data types involved so we can address the controls relevant to your workflow.