Security & data
Built so your documents stay yours
You are being asked to put incorporation documents, ownership structures and passports into someone else's platform. Here is exactly where they go, who can reach them, how long they stay, and which certifications are ours and which are not — answered before your compliance team has to ask.
You keep control of your own funds, start to finish
There is no Nelum account in the middle of your trade and no balance we could freeze. Nelum is not a bank or an escrow agent: payment between you and your counterparty stays with your own banks.
Settlement of any trade is conducted directly between the counterparties through their own banking and payment arrangements. Nelum does not hold, control, custody, transmit, or have any power to move client funds at any time.
Seven controls, and what each one gives you
Each of these is enforced by the system rather than promised by a policy, which is the difference that matters when you are deciding whether to upload a passport.
Your verification documents have no read path
Incorporation certificates, ownership registers and identity documents go into private storage the platform cannot read back. Once submitted they cannot be downloaded again — by anyone, including the company that submitted them and including us. There is nothing to leak through the product surface, because there is no surface.
Your private messages are ones we cannot read
A one-to-one conversation between two people is encrypted in the sender's browser, to keys only the two of them hold. We store the ciphertext and have no key to it — not for moderation, not under a court order, not for you if you ask. That is a property of how it is built rather than a policy we could change: the server refuses a plaintext message on such a thread outright. The cost is real and we state it rather than bury it — lose your passphrase and your recovery code and that history is gone, for you and for us.
Your business correspondence stays readable, on purpose
A thread involving a company, or hung on an offer, is the audit trail of what two counterparties agreed, and being able to produce it is the product. Those are not encrypted to you alone, and the conversation says which kind it is, permanently, in the thread. Which regime a message is in is decided by the server from the thread itself — never by a setting either side can flip after the fact.
Your access rules live in the database
Row-level security governs every read. Your company sees its own records and the consignments it is a party to; on a consignment, each party sees only what has been released to it. It is enforced beneath the application, so a missing check in a page cannot widen it.
You choose when your company is named
An intent can be anonymous: verified companies read its terms and see “Verified business”, never your name. You tell a company who you are when you choose to, one company at a time, from the conversation. The terms of an anonymous intent may not contain your company’s name, and its papers stay closed until you name yourself.
Every action carries a name and a time
Document filings, requests, role changes and verification decisions are all recorded with the actor and the timestamp. Governance events record which fields changed and never the values, so the trail proves a change occurred without becoming a second copy of your data.
Your retention period is stated, not assumed
Trade documents are kept for six years. Verification records are kept for the period anti-money-laundering law requires after the end of the relationship. Where that obligation applies we tell you it applies, rather than quietly keeping data or quietly deleting evidence.
What is certified, and what is not
Nelum holds no security certification of its own. We have not been through an ISO/IEC 27001 certification or a SOC 2 audit, and this page is not going to imply otherwise to a compliance team that would be right to check. What follows is how each part of the system is protected.
Nelum's own posture
No ISO/IEC 27001 certificate, no SOC 2 report, no qualified trust service provider status. What we have instead is the seven controls above — each one a property of how the system is built, each one checkable against what the product actually does. When any of that changes we will say so here, with the certifying body and the certificate number, exactly as we do for our vendors below.
Identity and business verification
KYB on the company, KYC on the people who can act for it, sanctions and PEP screening, and biometric liveness tested against presentation attacks under ISO/IEC 30107-3 rather than assumed safe. The checks are run by a specialist provider whose security is independently audited; that audit is the provider's, not Nelum's.
Where the record lives — in the Netherlands
Documents, correspondence and the trade record are held and served in the European Union, in the Netherlands, encrypted at rest and in transit by default. The infrastructure is independently audited; that audit covers the infrastructure, and nothing about whether our application on top of it was.
Payments — processed by Stripe
Subscriptions and AI credits are processed by Stripe, which publishes certification to PCI DSS Service Provider Level 1. Card details are collected and held by Stripe: they never touch Nelum's systems, and Nelum never holds client funds. That certification is Stripe's.
Stated precisely: every certification described above belongs to the provider that holds it, and describing a standard is not a claim to hold it. Nelum is not certified against ISO/IEC 27001, has not been through a SOC 2 audit, is not accredited by any of the bodies whose frameworks this site describes, and is not a qualified trust service provider under eIDAS. A certificate covering a provider we use does not cover us.
Your rights over your data
You can access, correct and port your personal data, and withdraw consent where processing rests on it — including to your profile photograph, which you can remove from your profile at any time.
Where anti-money-laundering law requires us to retain a verification record, that obligation takes precedence over a deletion request. We will restrict the record to meeting the legal obligation and tell you we have done so. A subject access request returns your encrypted private conversations as the ciphertext we hold, and says so on the export — we cannot decrypt them for you any more than for anyone else. The full detail is in our Privacy Notice.
Questions before you register?
If your compliance or security team needs detail we have not published here, ask us directly and we will answer it — including where the answer is that we do not hold something.