Security
Security: what you can actually rely on
Two kinds of security, two answers: that of operations and that of the service.
Access by roles and permissions, mission traceability, encryption, hosting in Switzerland, availability target and support: on this page, each commitment refers to its source, Terms of Use, service level agreement or data processing agreement.
15-day free trial · 2 licences included · No payment method required
Two notions
Operational security and service security are not the same thing
The first concerns what happens on the site and on the road: who did what, when, with which truck. The second concerns your data and access to the service: encryption, hosting, availability, continuity.
Operational security
The traceability of a mission makes it possible to find who, what, when, for which site, with which truck and which driver. Occupational safety (accidents, PPE, prevention plans) remains carried by your dedicated systems.
Nereva for QHSE managersDigital security
Access by roles and permissions, encryption in transit and at rest, hosting in Switzerland, backups, security tests, incident notification: measures described in the contract, as best-efforts obligations.
Data hostingEveryone accesses their company’s information, within the limits of their role
A user receives a role, then an access type if they work in the back office. The role opens an interface, the access type opens sections. Each role remains limited to the account of its own company.
- Transport: Driver, or Back-office manager with the Superadmin, Accounting or Logistics access type
- Construction: Foreman, or Back-office manager with the Superadmin, Accounting or Logistics access type, the latter limited to the selected sites
- The company’s administrators add, modify, deactivate or delete users from the back office
- Each assigned role uses one licence; personal credentials, never shared (Terms of Use, art. 20.6)
Each mission keeps who, what, when, with which truck
A request thread records the carrier, the driver, the timestamped steps, the photos and the note. The truck position is collected during the mission, from acceptance to closure, never outside it.
- Steps timestamped by the Nereva Transports app: on the way to the site, request started, skip dropped or collected, drop at the sorting centre, closure
- Photos and digital note attached to the mission, visible to both companies according to roles and permissions
- Geolocation limited to active missions; route history visible to the principal for 30 days by default, if the carrier has enabled it
- These elements are the faithful reflection of the entries made by users (Terms of Use, art. 16 bis)
Service security
Measures described in the contract
The technical and organisational measures below are those described in the contractual documents. They are best-efforts obligations (Terms of Use, art. 20).
| Measure | What the contract says | Source |
|---|---|---|
| Encryption | Encryption of data in transit (TLS 1.2 or higher) and at rest, databases and backups included. | DPA, art. 9 and annex 2 |
| Access control | Access on the least-privilege principle; strengthened authentication for Nereva’s administrative access; logging of sensitive actions. | Terms of Use, art. 20.2 |
| Backups and recovery | Regular data backup; documented business continuity and disaster recovery plans; indicative target objectives: recovery point 24 hours, recovery time 48 hours. | SLA, art. 14 |
| Tests and patches | Periodic security tests, vulnerability monitoring and patching, separation of development, test and production environments. | Terms of Use, art. 20.2 |
| Incidents | Notification of a significant security incident no later than 72 hours after becoming aware of it; data breach notified according to the DPA; major incident: targeted information within a 60-minute target, updates at least every 2 hours, post-incident report on request. | Terms of Use, art. 20.5 · SLA, art. 13 |
| Hosting | AWS infrastructure in Switzerland (Zurich region); AWS data centres certified ISO 27001 and equivalent standards (certification of the hosting provider). | DPA, annexes 2 and 3 |
| Organisation | Information security training for staff, documented incident management procedure, periodic internal audits, selection of sub-processors. | Terms of Use, art. 20.3 |
This page sets out the measures described in the contractual documents; those documents are what binds Nereva.
Availability and support
99.5%: what the figure means
The 99.5% rate appears in article 4 of the service level agreement (SLA) and article 17 of the Terms of Use. Here is its exact scope.
| Point | What the SLA says | Source |
|---|---|---|
| Nature | Monthly availability target of 99.5%, as a best-efforts obligation: a contractual target, backed by service credits if it is not met. | SLA, art. 1 and 4 |
| Period and scope | Measured per calendar month, separately for three indicators: the web back office, the mobile apps and the APIs. | SLA, art. 3 and 5 |
| Exclusions | Announced scheduled maintenance, emergency maintenance, the client’s network and devices, third-party systems, the hosting provider beyond its commitments, attacks not attributable to Nereva, force majeure; unavailability of less than 5 minutes is not counted. | SLA, art. 6 |
| Service credits | If the observed rate is below 99.5%: credit of 5%, 15% or 30% of the monthly pro rata of the indicator concerned depending on the tier, on written claim within 30 days, capped at 50% of an average month per calendar year; exclusive remedy. | SLA, art. 8 to 10 |
| Who is concerned | Clients who have subscribed to the Services; the SLA does not apply to pilots and beta testers. Different levels can be agreed by purchase order. | SLA, art. 1 and 4 |
| Maintenance | Scheduled maintenance outside business hours, preferably between 22:00 and 06:00 (CET), with 48 hours’ notice, or 7 days beyond 2 hours; total limited to 12 hours per month. | SLA, art. 7 |
| Support | Standard technical support included. Target first-response times, in Swiss business hours: critical incident 2 hours (08:00-20:00), high problem 4 hours, standard request 1 day, information 3 days. These times apply to the first response. | SLA, art. 12 |
Data and privacy
Your data, your rights, the documents that govern them
The Client remains the controller, Nereva acts as processor. The Client’s data remains its property; derived data, irreversibly anonymised, and the models belong to Nereva.
Privacy policy
Data collected, purposes, retention periods, rights of individuals, breach notification.
Read the policyData processing agreement
Roles, security measures, authorised sub-processors, transfers, fate of data at the end of the contract, audit.
Read the DPAAI and data policy
Separation of data lake zones, irreversible anonymisation, training purposes, human control.
Read the AI policyTerms of Use
Data ownership (art. 10), security (art. 20), availability (art. 17), evidential value (art. 16 bis).
Read the Terms of UseWritten commitments
Written commitments, sourced from the contract
What the contract documents
- Encryption in transit and at rest
- Hosting in Switzerland with AWS, data centres certified ISO 27001 (provider)
- Availability target of 99.5% per month and service credits
- Notification of incidents and data breaches
- Standard support included, in business hours
How to read these commitments
- Each measure refers to its article: Terms of Use, service level agreement or data processing agreement
- The certifications cited (ISO 27001 and equivalent standards) are those of the AWS data centres that host the platform
- The commitments are best-efforts obligations, specified by the contract (Terms of Use, art. 20)
- Alternative service levels and extended support can be agreed by purchase order
- The full documents can be consulted on the site’s legal pages
Processing is designed to comply with the GDPR and the FADP, under the conditions described by the privacy policy and the DPA.
Go further
The pages and documents that complement security
- Data hostingWhere your data goes, who accesses it, for how long
- QHSE managerFinding operations and their supporting documents
- Mobile appsNereva Transports and Nereva Commandes: missions, evidence, notifications
- Service level agreementAvailability, service credits, support, continuity
- Data processing agreementSecurity measures and authorised sub-processors
- Privacy policyData, retention periods, rights of individuals
Your questions
Security, plainly
How do roles and permissions work?
From the back office, the company’s administrators assign each user a role (Driver or Back-office manager on the transport side; Foreman or Manager on the construction side) and, for a manager, an access type: Superadmin, Accounting or Logistics. Everyone accesses their company’s information, within the limits of their role.
Can an access be removed?
Yes. The company’s administrators deactivate or delete a user from the back office. The Terms of Use require the Client to revoke without delay the credentials of a user whose duties end (art. 20.6).
What is Nereva’s level of availability?
The SLA sets an availability target of 99.5% per calendar month, measured separately on the web back office, the mobile apps and the APIs, as a best-efforts obligation. Scheduled maintenance windows and other cases are excluded from the calculation. If the rate is lower, service credits are provided for, on claim.
What technical support does Nereva offer?
Standard technical support, included, by e-mail at support@nereva.com, in Swiss business hours. Target first-response times range from 2 business hours for a critical incident to 3 business days for an information request; these times apply to the first response. Extended support can be agreed by purchase order.
Is the data encrypted?
Yes: in transit (TLS 1.2 or higher) and at rest, databases and backups included, according to the data processing agreement.
Is Nereva ISO 27001 certified?
No: the ISO 27001 certification, and equivalent standards, are those of the Amazon Web Services data centres in Switzerland that host the platform.
What happens in the event of an incident?
A significant security incident is notified to the Client no later than 72 hours after becoming aware of it; a data breach follows the DPA procedure. In the event of a major incident affecting the platform, the administrators of the clients concerned are informed (60-minute target), then kept informed at least every 2 hours, with a post-incident report on request.
Does Nereva step into the commercial relationship?
No. Your partners and your business relationships remain yours. Nereva synchronises operations without stepping into the commercial relationship. It takes no commission on flows.
Other questions? The general FAQ gathers the answers on security, compliance and availability.
Go furtherAccess, confidentiality, protection: our approach to security.
15-day free trial with 2 licences. No payment method required. Monthly subscription afterwards, no long-term commitment.