Last updated: 2026-07-10
Nely Rose operates nelyrose.com with administrative, technical, and organizational controls designed to meet SOC 2 Type I Trust Service Criteria for Security and Privacy.
This page is the authoritative public summary of how we protect personal data collected through the public website and admin systems. It does not cover consulting engagements or third-party tools used outside this site.
Our website security program is designed to meet SOC 2 Type I Trust Service Criteria for Security and Privacy. Type I evaluates whether controls are suitably designed at a point in time for the in-scope system: the public site, contact and privacy request forms, SQLite datastore, admin panel, and outbound email notifications.
When an independent attestation report is issued, we will update this page with the report date and scope reference. Until then, the statements on this page describe our control design intent — not a completed audit opinion.
We rely on Hostinger (hosting and SMTP), Cloudflare (Turnstile and edge protection), Google Analytics 4 (consent-gated analytics), and Calendly (optional scheduling embed). See our Privacy Policy for details and international transfer information.
If you believe you have found a security vulnerability on nelyrose.com, contact [email protected] with enough detail for us to investigate. Please do not publicly disclose issues before we have had a reasonable opportunity to respond.
No — and we do not claim certification. Nely Rose's website security program is designed to meet SOC 2 Type I Trust Service Criteria for Security and Privacy. Type I attestation evaluates control design at a point in time; we will publish attested language only after an independent report is issued.
The in-scope system includes the public website, contact and privacy-rights forms, the SQLite personal-data store, the admin panel, and outbound email notifications for form submissions. Consulting work in external CRM or email tools is out of scope.
nelyrose.com uses HTTPS/HSTS, CSRF and Turnstile on public forms, IP-based rate limiting, bcrypt admin passwords with optional TOTP MFA, append-only audit logging, SQLite outside the web root, encrypted database backups, and automated data retention.
Primary subprocessors are Hostinger (hosting and SMTP), Cloudflare (Turnstile and edge protection), Google Analytics 4 (consent-gated analytics), and Calendly (optional scheduling embed). Details appear in the Privacy Policy.
Email [email protected] with reproduction steps and impact. Do not publicly disclose vulnerabilities before Nely Rose has had a reasonable opportunity to investigate and remediate.
