BeyondNets Security

1. SECURITY PROGRAM

BeyondNets maintains a security program designed to protect the confidentiality, integrity, and availability of information and systems under its control.

Security measures are selected according to the nature of the system, information, service, and associated risks.

No security program can eliminate every risk or guarantee that a cybersecurity incident will never occur.

2. DEFENSE IN DEPTH

BeyondNets uses a defense-in-depth approach that may include multiple administrative and technical safeguards rather than relying on a single security technology.

Controls may include identity and access management, network security, endpoint protection, logging and monitoring, vulnerability management, secure configuration, encryption, backup protections, and incident-response processes.

3. IDENTITY AND ACCESS MANAGEMENT

BeyondNets applies access controls designed to limit access to systems and customer information to authorized personnel with a legitimate business need.

Depending on the system and risk, controls may include:

• Unique user accounts;
• Role-based or least-privilege access;
• Multi-factor authentication;
• Privileged-access restrictions;
• Authentication logging;
• Periodic access review; and
• Prompt modification or removal of access when responsibilities change.

4. CUSTOMER CREDENTIALS AND SECRETS

Managed technology and cybersecurity services may require BeyondNets to process passwords, API keys, tokens, certificates, service-account credentials, or other secrets.

BeyondNets seeks to limit access to such information and use secure methods appropriate to the sensitivity and technical requirements of the applicable Service.

Customers should avoid sending privileged credentials through ordinary unencrypted email or other insecure channels.

5. ENCRYPTION

BeyondNets uses encryption and secure communication protocols where appropriate and technically feasible to protect sensitive information in transit and at rest.

The precise encryption controls depend on the applicable platform, provider, integration, and customer environment.

6. NETWORK AND INFRASTRUCTURE SECURITY

BeyondNets uses security controls designed to reduce unauthorized access and protect infrastructure.

Depending on the environment, these controls may include firewalls, segmentation, secure remote access, hardened configurations, access restrictions, monitoring, and other network security technologies.

7. VULNERABILITY AND PATCH MANAGEMENT

BeyondNets uses processes intended to identify and address vulnerabilities affecting systems under its responsibility.

Remediation decisions may consider severity, exploitability, known exploitation, exposure, operational impact, vendor guidance, compatibility, and available mitigations.

For customer-managed or shared-responsibility environments, remediation responsibilities are governed by the applicable scope of services.

8. LOGGING, MONITORING, AND DETECTION

BeyondNets may maintain logs and monitoring capabilities designed to support security operations, troubleshooting, access review, threat detection, incident investigation, and system reliability.

The specific monitoring performed for a customer is determined by the applicable contracted Services and should not be assumed solely because BeyondNets has technical access to a system.

9. NCERIO SECURITY

NCERIO is designed to analyze authorized customer environments and identify security-relevant conditions, including configuration weaknesses, vulnerabilities, firmware conditions, known exploited vulnerabilities, access-control concerns, and compliance-related findings.

NCERIO access and data handling are designed around authorized customer use and applicable contractual permissions.

NCERIO findings represent conditions identified using information, access, integrations, detection logic, and threat intelligence available at the time of analysis. No assessment platform can guarantee identification of every vulnerability, misconfiguration, compromise, or threat.

10. ASK NCERIO AND AI SECURITY

AI-assisted features may process authorized customer context to provide analysis and recommendations.

Unless expressly agreed otherwise, BeyondNets does not use Customer Confidential Information, private network configurations, customer security logs, customer credentials, or private Ask NCERIO conversations to train public or generally available third-party AI models.

AI-generated recommendations should be reviewed by qualified personnel before consequential changes are implemented.

11. CUSTOMER DATA

Customer data is accessed and processed only as reasonably necessary to provide, secure, support, and administer applicable Services and as otherwise authorized by contract or law.

As between BeyondNets and the customer, ownership and permitted use of customer data are governed by the applicable agreements and BeyondNets Privacy Policy.

12. PERSONNEL AND CONFIDENTIALITY

Personnel and contractors with access to sensitive information are expected to follow applicable security and confidentiality requirements.

Access is intended to be limited according to job responsibilities and legitimate business requirements.

13. SERVICE PROVIDERS AND SUBPROCESSORS

BeyondNets may use cloud providers, hosting providers, communications platforms, security vendors, software providers, and other subprocessors or service providers.

BeyondNets evaluates security and contractual considerations appropriate to the services those providers perform and the information they process.

Additional subprocessor requirements may be established in applicable customer DPAs or agreements.

14. BACKUP AND RESILIENCE

BeyondNets uses backup, recovery, continuity, or resilience controls where appropriate for systems under its responsibility.

Backup and disaster-recovery obligations for customer environments depend on the applicable contracted scope.

No backup system can guarantee successful recovery under every circumstance. Customers should ensure their contractual recovery requirements, recovery point objectives, and recovery time objectives are expressly documented where required.

15. INCIDENT RESPONSE

BeyondNets maintains processes intended to identify, investigate, contain, remediate, and recover from cybersecurity incidents affecting systems or information under its control.

Incident-response actions may include investigation, containment, credential protection, system isolation, remediation, recovery, and communication with affected stakeholders as appropriate.

Customer notification obligations are governed by applicable law and contractual commitments.

16. RESPONSIBLE SECURITY REPORTING

Security researchers, customers, partners, and other individuals who believe they have identified a potential security vulnerability affecting a BeyondNets-owned system or NCERIO should report it privately to BeyondNets rather than publicly disclosing the issue before BeyondNets has a reasonable opportunity to investigate.

Reports should include, where reasonably available:

• A description of the suspected vulnerability;
• The affected system or URL;
• Steps necessary to reproduce the issue;
• Potential security impact; and
• Contact information for follow-up.

Reports may be sent to [email protected].

Reporters must not use security research as a reason to access customer data, disrupt services, destroy or alter information, conduct social engineering, deploy malware, extort BeyondNets or its customers, or violate applicable law.

17. SECURITY ASSESSMENTS AND COMPLIANCE

BeyondNets may use recognized cybersecurity frameworks, standards, benchmarks, vendor guidance, and threat intelligence to inform its security practices and Services.

References to frameworks or standards do not constitute a representation or certification that BeyondNets or NCERIO has obtained a particular independent certification unless BeyondNets expressly states that the certification has been obtained and remains current.

18. SHARED RESPONSIBILITY

Security is a shared responsibility.

Customers remain responsible for areas outside BeyondNets' contracted scope, including appropriate user behavior, authorization decisions, internal policies, physical security, supported hardware and software, licensing, and timely approval of recommended remediation unless an applicable agreement expressly assigns those responsibilities to BeyondNets.

19. SECURITY CHANGES

Cybersecurity threats, technologies, and practices evolve. BeyondNets may update its security controls and this Security page as appropriate to address changing risks, technologies, business requirements, and legal obligations.

20. SECURITY CONTACT

Suspected vulnerabilities or security concerns affecting BeyondNets-owned systems or NCERIO should be reported to [email protected] or using the contact information published on the official BeyondNets website.