One contract, one party
Consultancies and integrators contract with us, and their client sees their firm throughout. Enterprise teams contract with us directly.
← How it works
Security, data and accountability.
What partners and their clients ask before work starts: who answers if something goes wrong, who owns what, how the work is secured, and which standards apply. Plain answers, and nothing we cannot stand behind.
- Who answers
- Nessoris, with professional indemnity insurance
- Who owns the work
- As your contract sets it, from the start
- Security tier
- Chosen per engagement
- Certifications
- ISO 27001 or SOC 2 partners where required
One party answers for delivery.
Nessoris contracts with you and answers for its delivery partners, and carries professional indemnity insurance.
Our delivery partners are ours to manage
You never manage our delivery partners or individual engineers yourself. We do, and we answer for them.
If a package fails its acceptance test
We investigate with you and tell you what caused it. Work that does not meet the agreed test is fixed at our cost and tested again; a change to what was asked for is agreed as a change. Anything unresolved goes to the Nessoris founders, and the contract sets the final route.
Who owns what.
Code, documentation and the delivery record follow the partner firm’s contract with its client, if you are a consultancy or integrator, or your own contract, if you are an enterprise team. Transfer terms are set at the start.
You keep what you choose; the layers we cover are ours to answer for. The split is agreed at the start of each engagement and can change as the work does. Choose your split.
Security tiers, chosen per engagement.
Each engagement runs at the tier its data and its client require. A tier is built from these controls, chosen and priced with the work, and written into each package.
Client laptops or virtual desktops
The team works on your own laptops or virtual desktops, so data stays in your systems.
Ring-fenced rooms
A separate room for the people on your work, with access limited to them.
VPN
Connections to your systems run through a VPN.
Synthetic or anonymised data
Building and testing on synthetic or anonymised data instead of live records.
Development isolated from production
The team builds and tests away from the systems your business runs on.
Certifications and compliance.
Partners with ISO 27001 or SOC 2 are available where required; these are held by our delivery partners, not by Nessoris itself.
Our approach is aligned withAligned, not certified
- GDPRThe EU’s General Data Protection Regulation.
- PDPASingapore’s Personal Data Protection Act.
- NIS2The EU directive on cybersecurity for essential and important entities.
- EU AI ActThe EU’s rules for AI systems.
Where the work runs, and who does it.
The two questions every security review asks, answered before work starts.
Data location
Work runs in the environment the engagement specifies.
Subcontracting
Delivery partners are assessed before they are ever on call, and work under our management model.
The questions security teams ask first.
Straight answers. Ask us anything else on a call.
Is Nessoris itself ISO 27001 or SOC 2 certified?
No. Partners with ISO 27001 or SOC 2 are available where required; these certifications are held by our delivery partners, not by Nessoris itself.
Are you certified under GDPR, PDPA, NIS2 or the EU AI Act?
No. Our approach is aligned with GDPR, Singapore’s PDPA, NIS2 and the EU AI Act: aligned, not certified.
Who is accountable if something goes wrong?
Nessoris. We contract with you, answer for our delivery partners and carry professional indemnity insurance, so you never have to manage them yourself.
What happens if a package fails its acceptance test?
We investigate it with you and tell you what caused it. If the work does not meet the agreed test, we fix it at our cost and test it again. If what was asked for has changed, that is agreed as a change. Anything unresolved goes to the Nessoris founders, and the contract, agreed with the test before work starts, sets the final route.
Who owns the code and the documentation?
For consultancies and integrators, the code, the documentation and the delivery record follow the partner firm’s contract with its client. For enterprise teams, they follow your contract with us. Transfer terms are set at the start. The content is yours from day one, and the method can be too: we bring how we run packages (templates, checklists, tooling), and it can transfer with the capability to strengthen your own operating model. What we learn on your client’s work stays in your delivery record and is never reused for another client without your consent.
Can the work run on our own laptops or virtual desktops?
Yes. Where you need it, the team works on your own laptops or virtual desktops, so data stays in your systems. The security tier is chosen per engagement.
Do you use subcontractors?
Yes: our delivery partners. Each is assessed before it is ever on call, works under our management model, and is ours to answer for.
Bring us your security requirements.
Tell us what your client or your security team needs, and we will tell you which tier fits and what it involves.