Overview
Neural Web integrates security, privacy, and compliance considerations throughout the software development lifecycle. Our Secure Software Development Lifecycle (SSDLC) framework establishes requirements for designing, developing, testing, deploying, and maintaining NeuralRev and other Neural Web software products.
The framework is designed to reduce security risk, protect customer data, and support applicable regulatory and contractual obligations, including HIPAA and SOC 2 requirements.
Scope
This framework applies to Neural Web personnel and authorized contractors involved in:
- Software design and architecture
- Application and API development
- Infrastructure and configuration changes
- Software testing and quality assurance
- Production deployment and maintenance
- Vulnerability identification and remediation
The controls applied to a change are proportionate to its risk, complexity, and potential impact on customer data and production services.
1. Security Requirements and Design
Security and privacy requirements are considered during the planning and design of new products, features, integrations, and material system changes.
Depending on the nature and risk of the proposed change, the process may include:
- Identification of applicable security, privacy, and compliance requirements
- Review of data collection, use, transmission, retention, and deletion
- Assessment of authentication and authorization requirements
- Evaluation of third-party services and dependencies
- Architecture and data-flow review
- Threat modeling for material or higher-risk changes
- Definition of security acceptance criteria
Design decisions follow the principles of least privilege, defense in depth, secure defaults, data minimization, and separation of duties.
2. Secure Development Practices
Neural Web maintains documented engineering practices intended to prevent common software vulnerabilities and protect sensitive information.
These practices include:
- Use of approved source-control systems
- Role-based access to source code and development resources
- Protection of primary code branches
- Peer review of material code changes before production release
- Secure coding practices informed by recognized industry guidance, including the OWASP Top 10
- Prohibition against storing production credentials or sensitive customer data directly in source code
- Controlled management of application secrets and credentials
- Review and management of third-party software dependencies
- Separation of development, testing, and production environments
Production data is not used in non-production environments unless its use is authorized, necessary, and protected through appropriate security controls.
3. Security Testing
Software changes are subject to testing appropriate to their risk and potential impact. Testing may include:
- Functional and regression testing
- Static application security testing
- Software dependency and vulnerability scanning
- Secret detection
- Configuration and infrastructure review
- Authentication and authorization testing
- Application and API security testing
- Independent penetration testing
Identified issues are documented, evaluated, and prioritized based on severity, exploitability, affected data, and business impact.
4. Vulnerability Management
Security vulnerabilities identified through testing, automated scanning, third-party assessments, monitoring, or responsible disclosure are tracked through remediation.
Neural Web:
- Assigns severity using a risk-based classification methodology
- Prioritizes remediation based on technical severity and business impact
- Defines remediation expectations according to risk
- Escalates material vulnerabilities to appropriate engineering and security personnel
- Verifies remediation through retesting or other appropriate validation
- Documents risk acceptance or exceptions when immediate remediation is not practical
Critical issues that present an immediate and material risk may be addressed through an expedited change process.
5. Change and Release Management
Changes to production systems follow a controlled release process designed to reduce the risk of unauthorized changes, defects, and service disruption.
The process includes, as appropriate:
- Documented change scope and purpose
- Code review and required approvals
- Completion of applicable testing
- Assessment of security and operational impact
- Controlled deployment through authorized release mechanisms
- Validation following deployment
- Maintenance of relevant change and deployment records
- Rollback or recovery planning for material changes
Access to deploy or modify production systems is restricted to authorized personnel based on job responsibilities.
6. Production Protection and Monitoring
Neural Web applies security controls to protect production applications, infrastructure, and customer data. These controls include, as applicable:
- Role-based access and least-privilege permissions
- Multi-factor authentication for administrative access
- Encryption of sensitive data in transit and at rest
- Centralized logging and monitoring
- Audit logging for relevant security and administrative activity
- Backup and recovery controls
- Security alert investigation and escalation
- Periodic access reviews
- Controlled use of third-party services and subprocessors
Production access is limited, logged where appropriate, and reviewed in accordance with Neural Web's access-control requirements.
7. Third-Party Components and Services
Third-party libraries, infrastructure services, development tools, and software providers are evaluated according to the risk they present.
Relevant considerations may include:
- Access to customer or production data
- Security and compliance posture
- Known vulnerabilities
- Data-processing location and practices
- Contractual security and confidentiality obligations
- Business continuity and operational dependency
- Availability of security updates and support
Material service providers are managed through Neural Web's vendor-risk and subprocessor-management processes.
8. Security Training and Responsibilities
Personnel involved in software development receive security and privacy awareness training appropriate to their roles. Engineering personnel are expected to understand and follow Neural Web's secure development requirements.
Security is a shared responsibility across product, engineering, operations, and leadership. Material security concerns are escalated to the appropriate security or management owner.
9. Exceptions
Exceptions to this framework must be documented, evaluated for risk, approved by authorized personnel, and reviewed periodically when the exception remains active.
Compensating controls may be required based on the nature and severity of the risk.
10. Governance and Review
This framework is reviewed at least annually and following material changes to Neural Web's technology, regulatory obligations, risk environment, or software-development practices.
Supporting standards, procedures, and technical controls may be updated more frequently as technologies and security risks evolve.
| Framework owner | Security and Engineering |
|---|---|
| Review frequency | At least annually |
| Classification | External |
| Version | 1.0 |
Related Resources
- Secure System Engineering Principles
- Production Code Merge Process
- Vulnerability Management Policy
- Change Management Policy
- Access Control Policy
- Incident Response Plan
- Vendor Management Policy
For additional security or compliance information, please contact Neural Web through the NeuralRev Trust Center.