Security your IT team
can sign off on
Nevisible is SOC 2 Type II audited. It runs beside your website, not inside it: one DNS record for ai.yourcompany.com, read-only access to your host's logs, and a script that writes nothing to your visitors' devices.
SOC 2 Type II report available under NDA
- SOC 2 Type II
- Encrypted in transit and at rest
- No raw IP at rest
- Per-customer data
Security program
How we protect your data
Our controls are tested by an independent auditor as part of SOC 2 Type II.
Data protection
- Encryption in transit and at rest
- No raw IP address is stored: it is used to name the company, then kept only as a salted hash with its network and country
- Company-level only, with no device fingerprinting; a person is named only when they identify themselves
- Deletion on request cascades through every event, visit, lead and outcome
- Customer data deleted or returned within 30 days after a contract ends
Infrastructure
- ai. subdomains on Cloudflare's edge, with SSL certificates issued automatically
- App and API on Vercel; database, sign-in and file storage on Supabase
- Catalog uploads go straight to storage through short-lived signed URLs
- Every record belongs to one customer organization; company matches are never pooled across customers
- Append-only event log, time-stamped in UTC at the edge
- Data stored in the EU for EU and UK customers, and in Canada and the US for North American customers
- Daily backups of the platform database
Access control
- Admin and Member roles: only Admins see billing and company settings
- Reps act on alerts from email without a dashboard login, and can be limited to their own accounts
- Single sign-on with SAML and OAuth
- Billing through Stripe, so card details never reach Nevisible
- Security review of every vendor that handles data
- Security training for every staff member when they join and every year
Verified AI traffic
Only verified AI requests count
A user-agent string is a free-text header anyone can fake. Nevisible checks every AI request against a verification ladder before it counts toward a metric or a match.
Strongest
Signed request
The agent signs the request with Web Bot Auth (RFC 9421 HTTP Message Signatures), checked against the operator's published keys.
Strong
Published IP list
The request comes from an address on the AI operator's own published list, which Nevisible re-fetches on a schedule.
Moderate
Reverse DNS
Forward-confirmed reverse DNS ties the address back to the operator. Mainly Google and Bing support it.
Never counted
Unverified
A request that only claims a bot name is shown in your dashboard but left out of every metric and match.
Your website
Nevisible stays beside your site, not inside it
In the Standard setup your main site's pages, design and rankings stay as they are.
Default
Standard setup
The default for every customer. About 10 minutes of setup.
- One CNAME record for ai.yourcompany.com; your main domain's DNS is never touched
- Read-only log feed that keeps AI requests only and drops human lines
- Every ai. page carries a canonical tag to its page on your main site
- Remove it by deleting the record
Optional
Full Edge
By request, for teams that want AI requests to the main site seen in real time.
- Your www hostname routes through Nevisible's edge to your existing host, unchanged
- Shadow comparison before cutover, so forms, logins and redirects work end to end
- A kill switch and rollback by switching DNS back
- Added to your DPA, since Nevisible then handles every request to the site
Platform providers
Who runs which part of Nevisible
Nevisible is built on established cloud providers, each bound by contract to use data only to run our service.
| Provider | Role | What it does for Nevisible |
|---|---|---|
| Cloudflare | Edge network | Serves ai. subdomains, issues SSL certificates, logs and verifies AI requests |
| Vercel | Application hosting | Runs the Nevisible app and API, including event intake |
| Supabase | Database, sign-in, file storage | Stores account data, the event store and uploaded catalogs and certificates |
| OpenAI | AI processing | Extracts product data from your catalog and generates monitoring prompts |
| Pinecone | Search index | Holds catalog embeddings for product search and Ask Product Hub |
| Unstructured.io | Document parsing | Reads text and tables from uploaded PDF catalogs |
| Inngest | Job scheduling | Runs scheduled monitoring and background jobs |
| Resend and Slack | Alerts | Deliver rep emails and alerts you switch on |
| Stripe | Billing | Handles payment; card details never reach Nevisible |
| IP-to-company providers | Company matching | Name the company behind a business network |
The current subprocessor list, with locations, is available on request from privacy@nevisible.co.
Assurance
Tested, verified and on the record
SOC 2 Type II
An independent auditor tests our security controls over a review period. The report is available under NDA.
Request the report →Vulnerability reports
Found an issue? Email security@nevisible.co. We confirm receipt within 3 business days and send our initial assessment within 7.
Report an issue →Incidents
If a security incident affects your data, we notify you and the relevant authorities as the law requires, and keep a record of every breach.
Read our Privacy Policy →Security questions about Nevisible
Yes. Nevisible has completed a SOC 2 Type II audit, which tests that our security controls worked over a period of time, not only on one day. Customers and prospects can get the report under NDA from security@nevisible.co.
No. The Standard setup needs one DNS record (ai.yourcompany.com pointing to edge.nevisible.com), one robots.txt line, a script tag and a read-only log feed from your host. Nevisible never logs in to your CMS and never touches your main domain's DNS. Full Edge, available on request, routes your www hostname through Nevisible's edge and comes with a tested cutover, a kill switch and rollback by switching DNS back.
The ai. subdomains run on Cloudflare Workers for Platforms, which issues their SSL certificates and logs every AI request at the edge. The Nevisible app and API run on Vercel, and the database, sign-in and file storage run on Supabase. Payments go through Stripe, so card details never reach Nevisible. Platform data for EU and UK customers is stored in the EU, and for North American customers in Canada and the United States.
No. Every record in Nevisible belongs to one customer organization, and the company matches Nevisible learns from your traffic stay with your organization. They are not pooled across customers.
A user-agent string proves nothing, so Nevisible checks each AI request against a verification ladder: a cryptographic signature (Web Bot Auth, RFC 9421 HTTP Message Signatures), the operator's published IP list, or forward-confirmed reverse DNS. Requests that pass none of these are shown as unverified and left out of every metric and match.
No. The script is a few kilobytes, loads asynchronously and never blocks your page from rendering. It sets no cookies, writes nothing to the visitor's device and collects no device fingerprint.
Delete the DNS record and the script tag, and revoke the log feed. Your main site keeps working exactly as before. When your contract ends, we delete or return your platform data within 30 days.
Email security@nevisible.co with what you found and how to reproduce it. We'll confirm we received it within 3 business days, send our initial assessment within 7 business days, and keep you updated until it's fixed.
Bring your IT team. We'll walk them through it.
Send your security questionnaire to security@nevisible.co, or book a 20-minute technical walkthrough on your own domain.
SOC 2 Type II · Read-only access · Live in 48 hours
Last updated