Built to protect your company's data.
Designed to prove it.
Neurocity was designed from the first line of code around the controls today's security frameworks require. Here's how we keep your data isolated, encrypted and under your control, including the AI your people use.
Your data, kept apart
Isolation is built into how Neurocity stores data, not added on top.
A database for every company
Each company's data lives in its own database. It's never mixed with another company's, and every connection checks it has reached the right one.
Row-level security everywhere
Every table enforces row-level security, and the application can't bypass it. Your clients' portal users see only their own records.
Hosted in the United States
Neurocity runs on Microsoft Azure in the Central US region, behind Cloudflare's network protection.
Encryption and keys
What protects your data in transit, at rest, and the keys to your other systems.
Encrypted in transit and at rest
All traffic uses TLS, and stored data is encrypted at rest.
Keys sealed in a vault
Keys to the systems you connect are sealed in Azure Key Vault and opened only by the background worker that syncs them. The web application can't read them back.
Files built to NIST SP 800-171
Files sit in private storage, are scanned for malware before anyone can download them, and are downloaded only through one-time links.
Sign-in and access
Who gets in, and what each person can see and do.
Only the people you invite
Access is decided by your company's own list. Signing in with Microsoft or Google alone never gets anyone in.
No passwords to steal
People sign in with Microsoft, Google or a one-time code sent by email. Neurocity stores no passwords.
Roles and groups by department
Four built-in roles, plus groups that give exactly the rights each department needs. Change a group and everyone in it changes at once.
Access at a glance
One Security page shows who holds each key right, every connection and what it can read and change, every live app and automation, and every outside AI key, with a one-click way to end one.
AI under your control
AI that works inside your rules, including the AI tools your people bring.
AI sees what the person sees
Neurocity's AI reads your data with the permissions of the person asking, and can't change your systems on its own. It's optional and runs within a budget you set.
One front door for outside AI tools
Claude, Microsoft Copilot, ChatGPT and Cursor connect through Neurocity, sign in as the person, and act only with that person's current rights. Your company decides who approves them: each person, the company for chosen kinds of tool and groups, or both.
Never used for training
AI requests go to Anthropic, our AI provider, under terms that don't allow training on your data.
Find what's already connected
The Exposure add-on finds apps and AI tools with access to your Microsoft 365 data, and how they got in, and removes access with undo.
Change control and audit
Every change, from a person, an automation or AI, goes through the same rules.
Approvals by risk
Changes to your systems are risk-tiered actions with an impact preview. Risky ones wait for someone with the right to approve, and platform minimums can't be lowered.
Undo where it's possible
Most changes can be undone in one click; ones that can't say so before they run.
A tamper-evident audit trail
Every sign-in, data view, change and action is written to a hash-chained audit log, so a record can't be quietly altered.
Export everything
A global admin can download the whole company's data at any time.
How we run Neurocity
The practices behind the platform.
Reviewed, recorded changes
Infrastructure changes only go through reviewed, recorded deployments. Production databases don't allow password sign-in, and Neurocity staff access to production is limited and recorded.
Backups and recovery
Databases can be restored to any point in the last 35 days.
Breach notification
If a breach affects your data, we tell you without undue delay and within 72 hours of confirming it, with what we know and what we're doing.
No tracking in our email
Email from Neurocity doesn't track whether you open it or click its links.
Subprocessors
The companies that process data for us. We give at least 30 days' notice before adding or replacing one.
| Company | What for | Where |
|---|---|---|
| Microsoft Corporation (Azure) | Hosting, databases, key vault, email delivery | United States (Central US) |
| Cloudflare, Inc. | Network delivery and protection | Global network |
| Anthropic, PBC | AI features, only if your company turns them on | United States |
Compliance and reviews
How we help you meet your obligations, and how to report a problem.
Designed around the controls you're assessed on
Neurocity is built around the controls today's security frameworks require, and keeps the evidence auditors ask for: who has access, what changed and when. Certification is always your own assessment; we don't claim certifications we don't hold.
Security questionnaires
We answer reasonable security questionnaires and share our security documentation, as our Data Processing Agreement describes. Book a meeting and bring yours.
Report a security issue
Found a vulnerability? Email hello@neurocity.net with the details. Please give us a chance to fix it before sharing it, and don't access or change other people's data while testing.
Bring us your security questions
Book a short meeting with your IT or security lead. We'll walk through how Neurocity fits your requirements and answer your questionnaire.