Security & Compliance

Overview

Nely Rose operates nelyrose.com with administrative, technical, and organizational controls designed to meet SOC 2 Type I Trust Service Criteria for Security and Privacy.

This page is the authoritative public summary of how we protect personal data collected through the public website and admin systems. It does not cover consulting engagements or third-party tools used outside this site.

SOC 2 Type I program

Our website security program is designed to meet SOC 2 Type I Trust Service Criteria for Security and Privacy. Type I evaluates whether controls are suitably designed at a point in time for the in-scope system: the public site, contact and privacy request forms, SQLite datastore, admin panel, and outbound email notifications.

When an independent attestation report is issued, we will update this page with the report date and scope reference. Until then, the statements on this page describe our control design intent — not a completed audit opinion.

Technical controls

• HTTPS with HSTS and security headers on all public pages
• CSRF protection and Cloudflare Turnstile on public forms
• Server-side rate limiting by client IP address (Cloudflare-aware when proxied), including repeated invalid public form submissions after security checks
• Admin access protected by bcrypt passwords and TOTP two-factor authentication with replay protection
• Append-only audit logging for admin authentication and data changes
• SQLite database and server-side PHP session files stored outside the public web root with encrypted database backups
• Admin session idle timeout (8 hours of inactivity; activity resets the clock) and pending MFA expiry (30 minutes)
• Automated removal of stale server-side session files within 24 hours (request-triggered, no separate cron)
• Crawler policy: Internet Archive / Wayback bots and AI training permissions are controlled independently (see /robots.txt and Content-Signal); LLM crawlers remain allowed for search and ai-input
• Automated data retention aligned with our Privacy Policy

Subprocessors

We rely on Hostinger (hosting and SMTP), Cloudflare (Turnstile and edge protection), Google Analytics 4 (consent-gated analytics), and Calendly (optional scheduling embed). See our Privacy Policy for details and international transfer information.

Reporting security issues

If you believe you have found a security vulnerability on nelyrose.com, contact [email protected] with enough detail for us to investigate. Please do not publicly disclose issues before we have had a reasonable opportunity to respond.

Frequently asked questions

Is nelyrose.com SOC 2 certified?

No — and we do not claim certification. Nely Rose's website security program is designed to meet SOC 2 Type I Trust Service Criteria for Security and Privacy. Type I attestation evaluates control design at a point in time; we will publish attested language only after an independent report is issued.

What is in scope for SOC 2 Type I on nelyrose.com?

The in-scope system includes the public website, contact and privacy-rights forms, the SQLite personal-data store, the admin panel, and outbound email notifications for form submissions. Consulting work in external CRM or email tools is out of scope.

What security controls does nelyrose.com use?

nelyrose.com uses HTTPS/HSTS, CSRF and Turnstile on public forms, Cloudflare-aware IP rate limiting, bcrypt admin passwords with optional TOTP MFA (including replay protection), admin idle logout after 8 hours of inactivity, append-only audit logging, SQLite and session files outside the web root (unused session files removed within 24 hours), encrypted database backups, and automated data retention.

How does nelyrose.com handle web archiving and AI training crawlers?

Internet Archive / Wayback Machine access and AI-model training permission are separate operator settings. When archiving is disabled, ia_archiver and archive.org_bot are disallowed in robots.txt and public pages send noarchive. When AI training is disabled, robots.txt and HTTP Content-Signal set ai-train=no while LLM crawlers remain allowed for search and ai-input. See /robots.txt and /llms.txt for the live policy.

Who are the subprocessors for nelyrose.com?

Primary subprocessors are Hostinger (hosting and SMTP), Cloudflare (Turnstile and edge protection), Google Analytics 4 (consent-gated analytics), and Calendly (optional scheduling embed). Details appear in the Privacy Policy.

How do I report a security vulnerability on nelyrose.com?

Email [email protected] with reproduction steps and impact. Do not publicly disclose vulnerabilities before Nely Rose has had a reasonable opportunity to investigate and remediate.