Security at BreachLine Labs
Nebula is built for offensive security -and we apply the same rigour to protecting your data. Complete isolation, encrypted at every layer, and GDPR-compliant by design.
Compliance & Standards
GDPR Compliant
Full compliance with the EU General Data Protection Regulation and UK GDPR.
UK DPA 2018
Adherent to the UK Data Protection Act 2018 as a UK-registered company.
Cyber Essentials (Planned)
Pursuing Cyber Essentials certification to formalise our baseline security controls.
Security Measures
Customer Data Isolation
Each customer's Nebula environment is fully isolated at the infrastructure level. Scan results, credentials, and findings are never shared between customers. Enterprise customers deploy Nebula on-premise for complete data control with zero telemetry.
Encrypted Infrastructure
All data is encrypted at rest using AES-256 and in transit using TLS 1.3. API keys and credentials are protected with additional key-derivation layers. Infrastructure is hosted with geographic redundancy and strict access controls.
Access Control
Role-based access control (RBAC), multi-factor authentication, and full session management. Every API call and Nebula scan action is logged. Complete audit trails available to enterprise customers.
Continuous Security Testing
We deploy Nebula against our own infrastructure continuously -dogfooding our own product. Regular third-party assessments by external researchers. Active bug bounty programme for responsible disclosure.
Data Protection
As a UK-registered company, BreachLine Labs Limited processes personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Our approach to data protection includes:
- • Data Protection Officer (DPO) -A designated DPO oversees all data processing activities and can be reached at security@breachline.io.
- • Data Protection Impact Assessments (DPIAs) -We conduct DPIAs for any processing activity that may present a high risk to individuals' rights and freedoms.
- • Data Minimisation -Nebula only collects and retains the minimum data necessary to perform scans and deliver results. Scan data is purged according to configurable retention policies.
- • Lawful Processing -All personal data is processed under a valid lawful basis, typically legitimate interest or contractual necessity, and never sold to third parties.
- • Data Subject Rights -We honour all data subject rights including access, rectification, erasure, portability, and the right to object. Requests are handled within 30 days.
- • International Transfers -Where data is transferred outside the UK, we rely on approved safeguards such as Standard Contractual Clauses (SCCs) or adequacy decisions.
Responsible Disclosure
We appreciate the security research community's efforts in keeping Nebula and Breachline secure. If you discover a vulnerability in our platform or infrastructure, please report it responsibly.
- • Email: security@breachline.io
- • Please provide detailed reproduction steps
- • Allow us 90 days to address the issue before public disclosure
- • We offer rewards for qualifying vulnerabilities
Security Questions?
Contact our security team for any concerns.
BreachLine Labs Limited -167-169 Great Portland Street, 5th Floor, London W1W 5PF, United Kingdom
Contact Security Team