Security

NEXTBOUND Ltd applies a risk-based security programme designed to protect customer data, business workflows, integrations, and AI-enabled systems. Our controls are reviewed as our services, vendors, and customer requirements evolve.

Security is treated as a shared operational discipline across product design, implementation, infrastructure, and customer support. We aim to reduce practical risk while keeping systems usable for the teams that rely on them.

Access to internal systems is limited to authorised personnel who need it for their role. We use account controls, authentication requirements, and permission reviews to reduce unnecessary access to customer and business data.

Where possible, we apply least-privilege access, separate production responsibilities, and remove access when it is no longer required.

• Role-based access for internal tools and customer support workflows.
• Authentication requirements for administrative systems.
• Periodic access review for sensitive tools and environments.
• Prompt removal or adjustment of access when roles change.

We use reasonable technical and organisational measures to protect data against unauthorised access, loss, misuse, and alteration. These measures may include encryption in transit, secure configuration practices, logging, backups, and vendor controls.

Customer data is processed only as needed to provide, secure, support, and improve the services or as otherwise agreed with the customer.

NEXTBOUND Ltd may rely on trusted cloud providers, infrastructure platforms, analytics tools, communication services, and AI technology providers to deliver our services. We review vendors based on the role they play, the data they process, and the controls they make available.

Where appropriate, we use contractual safeguards and vendor security commitments to help protect customer information and support reliable service delivery.

AI projects often involve third-party models, APIs, data pipelines, and customer systems. We design integrations to minimise unnecessary data movement, keep implementation scopes clear, and apply controls that match the sensitivity of the workflow.

Customers should avoid submitting highly sensitive or regulated data unless the agreed configuration, vendor terms, and internal policies are appropriate for that use case.

We monitor systems and operational signals to detect reliability issues, misuse, and potential security events. When an incident is identified, we work to assess scope, contain risk, restore service, and communicate with affected customers where appropriate.

Incident response practices may vary based on the nature of the service, the customer environment, and the vendors involved.

Customers are responsible for managing their own users, permissions, devices, source systems, and data-sharing decisions. The security of an AI workflow depends on both NEXTBOUND Ltd controls and the configuration choices made by the customer.

We recommend using strong authentication, limiting access to sensitive data, reviewing generated outputs before relying on them, and keeping connected systems properly maintained.

No internet service, cloud provider, or AI system can be guaranteed to be completely secure. We work to reduce risk through reasonable safeguards, careful vendor selection, and ongoing review, but security also depends on customer configuration, user behaviour, and third-party systems.

Questions about security can be sent to security@nextbound.com. If you believe you have found a vulnerability or security issue, please include enough detail for us to investigate and avoid sharing sensitive customer data unless requested through a secure channel.