Trust & security
NERMO sits between your fleet and its suppliers, so we hold data both sides consider sensitive — vessels, routes, prices, purchasing history. The architecture treats that as the design constraint: isolated by default, encrypted at rest, and append-only where it counts.
Where your data lives
Your fleet's procurement record is yours — NERMO's job is to keep it structured, separated, and safe.
Fleet, vendor, and order data lives in EU infrastructure, under EU data-protection law.
Every client's and vendor's rows are fenced by row-level security in the database itself — deny-by-default, applied even to NERMO's own code. An application bug can't read across the fence, because the database refuses.
Compliance certificates, price lists, product photos — stored envelope-encrypted (AES-256-GCM) in private storage. Nothing is ever a public URL; bytes are served through authenticated proxies only.
Who can touch what
The strongest access control is the access that structurally cannot happen.
Exactly two backend processes hold database credentials. The web portals — and the document-extraction engine that reads uploaded files — hold none, by design. A compromised frontend has nothing to leak.
Sign-in runs on a dedicated, self-hosted identity provider speaking standard OAuth 2.0 / OIDC. NERMO's application tables store no passwords — there is no credential store to breach.
Permissions resolve per role, per capability, down to which vessels a session may act for — and a connected AI agent gets exactly the same treatment, never a backdoor. See NERMO over MCP.
Accountability
When money moves between three parties, the record of what happened must outrank everyone's memory of it — including ours.
Audit events are written once and can never be edited or deleted — not by your admins, not by NERMO staff. What happened is what the record says happened.
Whether an order was placed in the portal, over the API, or by an AI agent, the write lands in the same audit spine with the actor and surface recorded — and on the AI surface, every call an agent makes is recorded, reads included, from the moment it connects. There is no way to change state that doesn't log.
Every order-affecting operation carries an idempotency key, so a network retry or an over-eager agent can never turn one order into two.
Background jobs carry encrypted payloads, and a purpose-built linter blocks personal data from entering queues and logs in the first place — minimization enforced in code review, not remembered in a wiki.
Security review welcome. We answer security questionnaires and walk diligence teams through the architecture — ask for the detailed security overview.
AI access is optional and vendor-neutral. NERMO requires no particular AI vendor — a self-hosted model behind your firewall connects the same way. Details on the MCP page; the network's vetting and sanctions screening live under compliance.
Trust & security
Tell us about your fleet or your port — we'll answer your security team's questions in detail.
