Start my free week

Trust

Security and your data

Where your store's data lives, how it is protected and who can see it.

This page says where your store's data lives, how it is protected and who can see it. Everything here describes what is running today. If something changes, we change this page.

Where your data lives

  • neb runs on one server rented from RackNerd LLC, in a data centre in Buffalo, New York, USA. The website, the dashboard, the chat service and the database all run there, in separate Docker containers. The app runs as an unprivileged user.
  • The database is a single SQLite file on that server. It holds merchant accounts, store settings, the store pages neb has read, shopper conversations and the emails shoppers choose to leave.
  • Other companies handle specific jobs (AI answers, payments, email, encrypted backups). Each one and what it receives is listed under sub-processors.

Encryption

  • In transit: every page and API call uses HTTPS. Browsers are told to use HTTPS only (HSTS, preload).
  • Passwords are stored only as Argon2id hashes, never in readable form.
  • Store connection keys (for example a Shopify or WooCommerce access token) and the service keys neb uses are encrypted with AES-256-GCM before they are saved.
  • Backups that leave the server are encrypted first (see below).
  • The rest of the database (conversations, settings, store pages) is not separately encrypted on the server's disk. It is protected by the server's access controls described below.
  • Cards: merchants pay through Stripe's own page, so neb never sees or stores a card number. If a shopper types a card number, an email address or a phone number into the chat, it is masked before the message is saved, sent to the AI or logged.

Backups

  • The database is backed up every 6 hours on the server. Each backup is checked with SQLite's integrity check and kept for 14 days.
  • Every 6 hours, a copy is also encrypted (with age) and stored off the server, in Google Drive, for 30 days. Only we hold the key.
  • Restoring from a backup has been tested, and the steps are written down in our runbook.

Who can see your data

  • You: your conversations, reports and settings are visible only to the people who log in to your neb account.
  • The neb team: a small number of team admin accounts can open stores (including recent conversations) to run the service and help you. Admin accounts must use two-factor authentication, and every admin action is written to an audit log.
  • The server: only named team members can log in, with SSH keys (no passwords).
  • We do not sell your data or your shoppers' data, and we do not use your shoppers' data for advertising.

Protecting accounts

  • Login is locked for a while after repeated failed attempts, per address and per account.
  • The login cookie is HttpOnly, Secure and SameSite, so scripts on other sites cannot read or send it.
  • Each store has a public key for the widget. It only lets a page ask questions and read the widget's settings; it cannot open your dashboard. You can replace it from the dashboard at any time.

Protecting the service

  • Rate limits on logins, chat and the other public endpoints.
  • A strict Content Security Policy on this website, and browsers report anything it blocks.
  • Repeated attacks are banned at the firewall, and requests to known attack paths are banned on the first try. The files the website serves are checked every minute and restored if changed.
  • Security updates for the server install automatically every day.
  • Every code change goes through automated review and tests before it goes live, including secret scanning and a dependency audit.
  • When neb reads a store, it follows the store's robots.txt and only reads that store's public site.
  • Outside monitoring checks the site, the chat service, the widget, the dashboard and the HTTPS certificate every hour. See status.

How long data is kept

  • Shopper conversations are deleted automatically no later than 12 months after their last message.
  • This website's own visit measurements are deleted after 180 days.
  • To close your account and have your data deleted, use Account → Delete account in the dashboard. Backups that still contain it expire on the schedule above.

AI

In AI mode, the shopper's question, the recent conversation and the passages from your pages used to answer are sent to Anthropic to write the reply. Anthropic's commercial terms say they do not train their models on this data. We do not use your conversations to train any model. Each store's answers are drawn only from that store's own pages.

What we don't claim

neb does not hold third-party security certifications (such as SOC 2 or ISO 27001), and has not had an outside penetration test yet. We don't offer an uptime guarantee or SLA. We'd rather tell you that than imply otherwise.

Report a security problem

If you think you have found a security problem in neb, email hello@neb-app.com with the subject "Security". Please give us a chance to fix it before telling anyone else, and don't access other people's data while testing. We will reply by email. The full policy is on our security reporting page and in security.txt.

Last reviewed: 9 October 2026.

Back to the home page