Compliance

1. Approach

Nibelung operates in compliance with applicable law. As a young enterprise software company based in Austria, we build compliance into our operations through design principles, operational controls and ongoing assessment.

We do not currently hold formal certifications such as ISO 27001, SOC 2 or HIPAA. We are open about our current maturity and about our path toward certifications.

2. GDPR by design

As a company operating in the EU, Nibelung is subject to the General Data Protection Regulation. Its principles are built into our products:

Data minimisation

We collect and process only the personal data needed to provide our services. Default configurations limit collection; anything beyond that requires an explicit choice.

Purpose limitation

Personal data is processed only for the documented purposes set out in our privacy policy and service agreements. We do not reuse it for unrelated purposes without a new legal basis.

Storage limitation

Personal data is kept only as long as the stated purpose requires. Retention and deletion periods are defined in the privacy policy; deletion requests are handled within the GDPR deadlines.

Integrity and confidentiality

Personal data is protected against unauthorised access, alteration and destruction through encryption, access control and monitoring; the Security page describes the practice.

3. Data processing agreements

Where Nibelung processes personal data on behalf of a customer, we sign a data processing agreement under Art. 28 GDPR. It defines:

• the scope and nature of the processing
• its purpose and duration
• the categories of personal data and data subjects
• the obligations and rights of both parties
• sub-processors and their safeguards
• data subject rights and the customer's responsibilities
• transfer mechanisms (standard contractual clauses where applicable)

The agreement is provided on request and signed before any processing of personal data begins.

4. Auditability

We keep the records that demonstrate compliance:

• activity logs for access to sensitive systems and data
• audit trails of data processing and transformations
• change records for infrastructure and policies
• documentation of security assessments and incident responses
• records of data subject requests and the actions taken

These records are kept for audits and provided to customers or regulators as the law requires.

5. Customer responsibility

Compliance is shared. Customers are responsible for the legal basis of the data they provide, for informing their data subjects and obtaining consent where needed, for access control on their side, for notifying us promptly of breaches, and, in deployments in their own infrastructure, for the infrastructure and data location themselves.

6. Readiness, not certification

Current status

• no ISO 27001 certification
• no SOC 2 Type II report
• no HIPAA certification
• no industry-specific certification (PCI DSS or similar)

What we offer instead

Transparent documentation of our security practice, architecture and controls. Enterprise customers may conduct their own assessments or third-party audits of our infrastructure and processes.

Why

For a company of our size, formal certification is a large cost and a large overhead. We invest in the controls themselves first. Certifications may follow as Nibelung grows; we do not commit to dates.

7. Contact

Compliance questions, audit requests or specific requirements: info@nibelung.io (subject: Compliance).