Security, Compliance & Trust

Service infrastructure maintained

Neurameet has infrastructure supporting the service patched as a part of routine maintenance and as a result of identified vulnerabilities to help ensure that servers supporting the service are hardened against security threats.

Remote access MFA enforced

Neurameet's production systems can only be remotely accessed by authorised employees possessing a valid multi-factor authentication (MFA) method.

Remote access encrypted enforced

Neurameet's production systems can only be remotely accessed by authorised employees via an approved encrypted connection.

Production data segmented

Neurameet prohibits confidential or sensitive customer data, by policy, from being used or stored in non-production systems/environments.

Production application access restricted

System access restricted to authorised access only.

Network segmentation implemented

Neurameet's network is segmented to prevent unauthorised access to customer data.

Unique network system authentication enforced

Neurameet requires authentication to the production network to use unique usernames and passwords or authorised Secure Socket Shell (SSH) keys.

Unique account authentication enforced

Neurameet requires authentication to systems and applications to use unique username and password or authorised Secure Socket Shell (SSH) keys.

Production multi-availability zones established

Neurameet has a multi-location strategy for production environments employed to permit the resumption of operations at other company data centers in the event of loss of a facility.

Employee background checks performed

Neurameet performs background checks on new employees.

Password policy enforced

Neurameet requires passwords for in-scope system components to be configured according to the company's policy.

Security awareness training implemented

Neurameet requires employees to complete security awareness training within thirty days of hire and at least annually thereafter.

Production inventory maintained

Neurameet maintains a formal inventory of production system assets.

Asset disposal procedures utilised

Neurameet has electronic media containing confidential information purged or destroyed in accordance with best practices, and certificates of destruction are issued for each device destroyed.

Whistleblower policy established

Neurameet has established a formalized whistleblower policy, and an anonymous communication channel is in place for users to report potential issues or fraud concerns.

Vulnerabilities scanned and remediated

Host-based vulnerability scans are performed at least quarterly on all external-facing systems. Critical and high vulnerabilities are tracked to remediation.

Continuity and Disaster Recovery plans tested

Neurameet has a documented Business Continuity/Disaster Recovery (BC/DR) plan and tests it at least annually.

Incident response plan tested

Neurameet tests their incident response plan at least annually.

Access requests required

Neurameet ensures that user access to in-scope system components is based on job role and function or requires a documented access request form and manager approval prior to access being provisioned.

Backup processes established

Neurameet's data backup policy documents requirements for backup and recovery of customer data.

Incident response policies established

Neurameet has security and privacy incident response policies and procedures that are documented and communicated to authorised users.

Configuration management system established

Neurameet has a configuration management procedure in place to ensure that system configurations are deployed consistently throughout the environment.

Management roles and responsibilities defined

Neurameet management has established defined roles and responsibilities to oversee the design and implementation of information security controls.

Service description communicated

Neurameet provides a description of its products and services to internal and external users.

Security policies established and reviewed

Neurameet's information security policies and procedures are documented and reviewed at least annually.

Support system available

Neurameet has an external-facing support system in place that allows users to report system information on failures, incidents, concerns, and other complaints to appropriate personnel.

Roles and responsibilities specified

Roles and responsibilities for the design, development, implementation, operation, maintenance, and monitoring of information security controls are formally assigned in job descriptions and/or the Roles and Responsibilities policy.

Vendor management program established

Neurameet has a vendor management program in place. Components of this program include: critical third-party vendor inventory; vendor's security and privacy requirements; and review of critical third-party vendors at least annually.

Incident management procedures followed

Neurameet's security and privacy incidents are logged, tracked, resolved, and communicated to affected or relevant parties by management according to the company's security incident response policy and procedures.

Development lifecycle established

Neurameet has a formal systems development life cycle (SDLC) methodology in place that governs the development, acquisition, implementation, changes (including emergency changes), and maintenance of information systems and related technology requirements.

Cybersecurity insurance maintained

Neurameet maintains cybersecurity insurance to mitigate the financial impact of business disruptions.

Continuity and Disaster Recovery plans established

Neurameet has Business Continuity and Disaster Recovery Plans in place that outline communication plans in order to maintain information security continuity in the event of the unavailability of key personnel.

AI service provider agreements established

Neurameet has written agreements with AI service providers that include security, privacy, and data handling commitments.

Prompt injection protections established

Neurameet implements technical controls to prevent malicious prompt injection and ensure AI system integrity.

AI output validation procedures

Generated transcripts and minutes are validated for accuracy and security before delivery to users.

AI system access controls

Access to AI processing systems and configurations is restricted to authorised personnel only.

AI service monitoring established

Neurameet monitors AI service usage, performance, and security metrics to detect anomalies.

AI data retention policy established

Audio and processing data sent to AI services is deleted according to agreed retention schedules.

Data transmission encrypted

Neurameet uses secure data transmission protocols to encrypt confidential and sensitive data when transmitted over public networks.

Vulnerability and system monitoring procedures established

Neurameet's formal policies outline the requirements for the following functions related to IT / Engineering: vulnerability management; system monitoring.

Privacy policy established

Neurameet has a privacy policy is in place that documents and clearly communicates to individuals the extent of personal information collected, Neurameet's obligations, the individual's rights to access, update, or erase their personal information, and an up-to-date point of contact where individuals can direct their questions, requests or concerns.

Data retention procedures established

Neurameet has formal retention and disposal procedures in place to guide the secure retention and disposal of Neurameet and customer data.

Privacy compliant procedures established

Neurameet has documented processes and procedures in place to ensure that any privacy-related complaints are addressed, and the resolution is documented in Neurameet's designated tracking system and communicated to the individual.

Privacy policy available

Neurameet has a privacy policy available to customers, employees, and/or relevant third parties who need them before and/or at the time information is collected from the individual.

Privacy policy reviewed

Neurameet reviews the privacy policy as needed or when changes occur and updates it accordingly to ensure it is consistent with the applicable laws, regulations, and appropriate standards.

Privacy policy maintained

Neurameet has established a privacy policy that uses plain and simple language, is clearly dated, and provides information related to Neurameet's practices and purposes for collecting, processing, handling, and disclosing personal information including: organisational operating jurisdictions; an individual's choice and consent for the collection, use, and disclosure of personal information; an individual's right to access, update or remove personal information; a process for individuals to exercise their rights; requirements to only provide the essential information needed for the service; types or categories of information collected; purposes for the collection of information; methods of collection (cookies or other tracking techniques, etc.); consequences for not providing or withdrawing the essential information; sources of information (third parties, direct collection, etc.); types or categories of third parties (sources and disclosures); the purpose for disclosure of information to third parties.

Data classification policy established

Neurameet has a data classification policy in place to help ensure that confidential data is properly secured and restricted to authorised personnel.

Data deletion requests handled

Neurameet validates deletion requests and once confirmed are flagged and the requested information is deleted, in accordance with applicable laws and regulations.

Continuity and Disaster Recovery plans established

Neurameet has Business Continuity and Disaster Recovery Plans in place that outline communication plans in order to maintain information security continuity in the event of the unavailability of key personnel.

Continuity and Disaster Recovery plans tested annually

Neurameet has a documented Business Continuity/Disaster Recovery (BC/DR) plan and tests it annually.

Limit collection

Neurameet limits collection of PII to the minimum that is necessary for its purposes.

Customer data deleted upon leave

Neurameet purges or removes customer data containing confidential information from the application environment, in accordance with best practices, when customers leave the service.

PII transmission controls for processor

Neurameet encrypts PII in transit.

PII transmission controls for controller

Neurameet implements technical controls to ensure data transmitted to third parties reaches its destination.