[ Legal · Nomisma LLC ]

Security Overview and Vulnerability Disclosure

Version v1 · Effective 26 October 2026 · Last updated 26 October 2026

This page describes how Nomisma LLC ("Nomisma") protects Smartsteps and the data in it, and how to report a security vulnerability. It states what we do and what we commit to, without disclosing implementation detail that would help an attacker. Capitalised terms have the meanings given in the Terms of Service.

1. Infrastructure

1.1 Smartsteps is hosted on Amazon Web Services in the us-east-1 region (Virginia, United States). The application and the crawler run as containers on Amazon ECS with AWS Fargate. Data is stored in Amazon RDS for PostgreSQL and Amazon S3. Application secrets are held in AWS Secrets Manager. Transactional email is sent through Amazon Simple Email Service, DNS is served by Amazon Route 53, and operational logs and metrics are collected in Amazon CloudWatch. Uploaded documents are read by Amazon Textract where optical character recognition is needed, and AI inference runs through Amazon Bedrock.

1.2 Cloud components operate under least-privilege AWS Identity and Access Management roles, each granted only the permissions it needs. A web application firewall (AWS WAF) can be applied in front of the Service.

1.3 The full list of third parties that process data for Smartsteps is on the Sub-processors page.

2. Encryption

In transit. Connections to the Service are encrypted using TLS 1.2 or higher.
At rest. The database is encrypted at rest with keys managed in AWS Key Management Service. Files and evidence stored in Amazon S3 are encrypted at rest.

3. Evidence Integrity

Each analysis keeps a dated record of the crawl evidence it relied on, stored with the Workspace's other Customer Content and deleted with the Workspace. Retention is described in the Privacy Policy.

4. Account Security

Passwords are hashed with Argon2id. We never store passwords in readable form.
Email verification is required, and single-use sign-in links sent by email expire after a short time.
Account lockout. Repeated failed sign-in attempts temporarily block further attempts.
Uniform errors. Sign-in error messages are the same whether or not an account exists, so they do not reveal which email addresses are registered.
Server-side sessions. Sessions are stored on our servers and referenced by an httpOnly, Secure cookie, so a session can be ended server-side. Sessions last up to 30 days with "keep me signed in", or 12 hours without it. See the Cookie Policy.
Workspace access is limited to the Users of that Workspace, according to their role.

5. Staff Access

Nomisma staff use a separate administration site (admin.smartsteps.ai) with its own short-lived session.
Staff accounts require two-factor authentication using time-based one-time passwords.
Staff permissions are role-based. Support staff, who may include contractors bound by confidentiality obligations, can view the Workspace data needed to resolve a support ticket.
Staff access to Workspace data, and other security-relevant actions, are recorded in audit logs, which are retained for two years. Server and application logs are retained for one year.
Staff and contractors who can access personal data receive privacy and security training when they start and at least once a year.
Security updates to systems, containers and software dependencies are applied promptly, critical vulnerabilities first.

6. AI and Data Handling

AI inference runs through Amazon Bedrock. Amazon Bedrock does not use customer inputs or outputs to train the underlying models. Anthropic's API may be used as a fallback provider, as described on the Sub-processors page.
Nomisma does not use Customer Content to train AI models.
Passwords and payment details are never sent to AI models.
Payment card details are collected by Stripe and never reach Nomisma's systems.
See the AI Transparency statement for more detail.

7. The Crawler

SmartstepsBot identifies itself with the user agent "SmartstepsBot/0.1 (+https://smartsteps.ai/bot)". It never submits forms and does not record values typed into forms. Customers may only submit websites they own or are authorised to have scanned, as required by the Acceptable Use Policy. Website operators who believe SmartstepsBot visited their site without authorisation can write to info@nomisma.ai.

8. Backups, Deletion and Incident Response

8.1 Database backups expire within seven days. Account and Workspace deletion is described in the Privacy Policy and the Data Processing Addendum.

8.2 Nomisma maintains processes to detect, investigate and respond to security incidents. If a Personal Data Breach affects Customer Content, Nomisma will notify affected Customers without undue delay, as set out in the Data Processing Addendum.

9. Compliance Posture

Nomisma does not currently hold third-party security certifications and does not claim any. Amazon Web Services and Stripe maintain their own certifications for the services they provide. The Service is not designed to store health information, payment card data or special categories of personal data, and Customers must not submit them (see the Acceptable Use Policy). Security questionnaires can be sent to info@nomisma.ai.

10. Reporting a Vulnerability

10.1 If you believe you have found a security vulnerability in Smartsteps, please report it to info@nomisma.ai with the subject line "Security vulnerability".

10.2 Please include enough for us to reproduce the issue: the affected address or endpoint, the steps, what you expected, what happened, and any proof of concept. If the finding is sensitive, say so and we will arrange a more secure channel.

10.3 You do not need a Smartsteps account to report. You may report anonymously, although we cannot credit you or ask follow-up questions if you do.

11. Our Commitments to Researchers

We will acknowledge your report within five business days.
We will tell you whether we have accepted the finding, and give an expected remediation timeline, within ten business days of acknowledging it.
We will keep you updated and tell you when the issue is fixed.
We will credit you publicly if you wish, and will not name you if you prefer.
We will not take legal action against good-faith research conducted under this policy (see Section 14).

Nomisma does not currently operate a paid bug-bounty programme. Reports are welcome and taken seriously, but no payment should be expected.

12. Scope

In scope:

smartsteps.ai, including the web application at smartsteps.ai/app and its APIs;
the administration site at admin.smartsteps.ai (testing limited to the login surface, as you will not have staff credentials); and
infrastructure operated by Nomisma to support the above.

Out of scope:

services operated by third parties, including Amazon Web Services and Stripe (please report to them directly);
using Smartsteps to crawl or scan any website you do not own or are not authorised to test, including attempts to direct SmartstepsBot at third-party sites or internal addresses beyond what is needed to demonstrate a vulnerability against Nomisma's own infrastructure;
findings that require a compromised device, a stolen unlocked device, or a victim acting against their own interest;
missing security headers, cookie flags or TLS preferences without a demonstrated exploit;
rate-limiting or brute-force findings without demonstrated impact;
reports produced solely by automated scanners without analysis or a working proof of concept;
social engineering, phishing or physical attacks against Nomisma personnel or premises; and
denial-of-service, resource exhaustion or volumetric testing of any kind.

13. What We Ask of You

Do not access, modify, delete or keep data that is not yours. If you encounter someone else's data, stop, do not keep a copy, and tell us what you saw.
Use only accounts and Workspaces you own, and test only with websites and documents you own or are authorised to scan.
Do not degrade the Service: no denial-of-service, load testing or high-volume automated scanning.
Do not use spam, social engineering or physical intrusion.
Do not consume Credits or trigger analyses in other Customers' Workspaces.
Do not disclose the finding until we have fixed it or 90 days have passed since your report, whichever comes first. If you believe users are at immediate risk and we are not acting, tell us and we will agree a timeline with you.
Comply with applicable law.

14. Safe Harbour

14.1 If you make a good-faith effort to comply with this policy during your research, Nomisma will:

consider your research authorised under the Computer Fraud and Abuse Act and equivalent computer-misuse laws, and under any anti-circumvention provision of the Digital Millennium Copyright Act;
consider your research exempt from the restrictions in our Terms of Service and Acceptable Use Policy that would otherwise prohibit security testing, to the extent necessary for that research;
not pursue or support any civil or criminal action against you in connection with it; and
if a third party brings an action against you for research conducted under this policy, make it known that your actions were authorised by Nomisma.

14.2 This safe harbour covers only systems Nomisma controls. Nomisma cannot authorise testing of third-party systems, including Customer Websites, Amazon Web Services or Stripe.

14.3 This safe harbour does not apply if you access data beyond what is needed to demonstrate a vulnerability, keep such data, attempt extortion, or act in bad faith.

14.4 If you are unsure whether something is in scope or whether a test is acceptable, ask us first at info@nomisma.ai.

15. Contact

Security reports and questions: info@nomisma.ai. Nomisma LLC, 30 N Gould St, Ste R, Sheridan, Wyoming 82801, United States. Telephone +1 510-565-0510.