Pre-launch draft. These terms are being finalized. Current wording describes actual data handling and is provided so signup / claim flows can complete. Questions or concerns: justin@nerdrums.com.

Security

Last updated: 2026-07-22

Data classification

Nerdrums surfaces are UNCLASSIFIED. We do not accept Controlled Unclassified Information (CUI) or classified data. FedRAMP and GovCloud are pursued post-launch; a boot gate refuses production startup if CUI classification appears in the manifest.

Isolation

  • Row-Level Security on every Bearings Network table. Cross-organization reads and writes are blocked at the database layer, not just the app layer.
  • Encryption at rest via Google Cloud KMS keys per data class (session, corpus, company documents).
  • TLS-only for every ingress path. Boot gate refuses to serve if HTTPS enforcement is disabled in production.

Anti-spoofing

  • Claim verification runs a risk-based tier ladder: domain match (Tier 1), evidence submission (Tier 2), admin review (Tier 3). A SAM.gov POC is notified whenever a claim is submitted so the record's authoritative contact hears about it.
  • One-time codes are salted with a secret provisioned per environment; a boot gate refuses startup if the salt is missing on production. DNS TXT proofs and dispute-flow IP hashes follow the same discipline.
  • Per-user and per-organization rate limits on claim start and dispute submission.

Audit trail

Every disclosure-request state change and every claim transition writes to an append-only event table. Access to the admin queue is role-gated; the actor's user_sub is recorded on every action. CMMC AU-2 markers land in the centralized log stream.

Account deletion

  • You can request deletion of your Bearings Network account from the settings page. The request opens a 30-day grace window during which the account is soft-deleted: authentication is disabled, your organization record is hidden from public and matching surfaces, and disclosure requests you had open are cancelled.
  • Within the grace window you may cancel the request and restore the account. After 30 days a scheduled job permanently purges the account and every associated row — claim, team memberships, capabilities, facilities, evidence, disclosure history, notification preferences. The purge is irreversible; audit-log entries that reference your former user_sub are retained per CMMC AU-2 but no longer resolve to identifying information.
  • If someone else claimed to represent your organization and the record on Bearings Network is incorrect, use the public dispute flow on the record page instead — deletion is for your account, not for a record you don't control.

Responsible disclosure

Found something? Email justin@nerdrums.com with reproduction steps. We do not currently run a bug bounty; we do acknowledge every report and credit researchers who prefer public attribution.

Roadmap

Post-launch: FedRAMP Moderate + GovCloud regional deployment; CMMC L2 self-attestation; SOC 2 Type II.