NIC Portal Security Posture & SOC 2 Readiness
Demonstrating our technical security baseline, encryption standards, access control enforcement, and responsible disclosure program.
Encryption at Rest & Transit
All database records and file storage are encrypted at rest using AES-256. All network traffic is forced over TLS 1.3.
Row Level Security (RLS)
Granular Supabase Row Level Security ensures strict isolation. Users can only access records explicitly authorized by their role.
Automated Patching
Daily GitHub Dependabot scans ensure npm dependencies and Next.js engine packages are continuously patched against CVE vulnerabilities.
Trust Services Criteria (AICPA SOC 2 Mapping)
NIC Portal aligns with the AICPA SOC 2 Trust Services Criteria across five core domains:
Access controls, MFA authentication, environment variable isolation, and automated web security headers.
Vercel Edge global CDN distribution, Supabase Point-in-Time Recovery (PITR) backups, and 99.9% uptime target.
Strict NDPA 2023 compliance, data minimization policies, and user identity document encryption.
Responsible Vulnerability Disclosure Program
NIC welcomes security researchers and white-hat community members to report potential security vulnerabilities responsibly. We commit to acknowledging all submissions within 48 hours and implementing patches promptly.
Guidelines for Vulnerability Reporting:
- Do NOT access, alter, or destroy user data or system integrity.
- Do NOT execute denial-of-service (DoS/DDoS) attacks or social engineering.
- Submit detailed steps to reproduce the issue securely to our team.