Security & trust
Governance is part of how we generate infrastructure. It is not a later extra.
Identity, an audit trail that cannot be edited after the fact, and compliance checks against your actual infrastructure state — not a marketing checklist.
Identity and access
SAML/SSO and OIDC federated login, SCIM provisioning that keeps access in sync with your identity provider, and role-based access control scoped per tenant and per environment — not a single global admin/member split.
Sealed audit trail
Every action is recorded in a hash-chained audit log. Each entry cryptographically references the hash of the one before it, so tampering or deletion can be detected. Your team and auditors can review it. Nobody can edit it. You can export it for SIEM ingestion.
Regulatory compliance evaluation
6 packs — SOC 2, HIPAA, PCI-DSS, and CIS Benchmarks for AWS, Azure, and GCP — evaluated live against your actual Terraform plans. Violations are found by parsing real plan and state resources against each pack's controls, not read off a static checklist. Other frameworks (GDPR, DORA, NIS2) can be evaluated as policy inputs — that's evaluation, not certification.
Fail-closed AI guardrails
When the planning or Terraform agent cannot get a confident answer from the model — a timeout, or an invalid tool call — it stops and asks you. It does not guess with a heuristic fallback. Nothing gets drafted from a guess by default.
Prompt-injection detection
Untrusted content pulled into a chat turn — RAG results, tenant memory, vendor docs — is wrapped and screened for injection attempts before it can influence which tools run. A confirmed attempt blocks the mutating tool call, not just a logged warning.
Report a vulnerability
Email security@nebulastack.io with the product or component, impact, and non-destructive reproduction steps. Do not open a public GitHub issue for unfixed vulnerabilities. We acknowledge reports within two business days and ask for a 90-day coordinated disclosure window unless an actively exploited issue requires earlier customer notice.
Researchers can discover this contact via /.well-known/security.txt (RFC 9116).
What this page doesn't claim: NebulaStack does not yet publish a completed third-party audit report (SOC 2 Type II, ISO 27001 certification) — those are processes with a real timeline, not something to imply before it's true. If a specific attestation is a requirement for your evaluation, contact NebulaStack about attestations directly and we'll tell you exactly where that stands.