Vendor Due Diligence Questionnaire

1. Company Information

Nyx Labs Ltd, a private limited company registered in England and Wales. Pre-seed stage; the product is live in production at nyxsuite.com.

Nyx Labs Ltd

16842575

10 November 2025

100% founder-owned.

One — the founder. See Section 13, Key Personnel & Key-Man Risk.

5 Bisham Court, Bisham, Marlow, England, SL7 1SD

2. Product & Scope

NYX Suite is software — the operating system for emerging funds: a live ledger, risk desk, and LP reporting layer. It is not a fund administrator. The client's fund administrator's NAV remains the official NAV of record; Nyx produces a shadow NAV that reconciles against it, using a detect-and-reconcile model, never a write-time lock.

No. Tax-lot and regulatory outputs are a raw-data handoff to the preparer who signs the filing. The platform exports underlying data rather than rendering a finished tax form, investor schedule, or regulatory report, and it does not allocate realised gains across investors — the preparer owns allocation methodology.

3. Access to Client Assets

No. Nyx never has custody or transfer capability. Exchange and stock-broker connections use API credentials the client supplies (or, for SnapTrade-aggregated brokers, a hosted read-only portal connection); the platform requests read-only keys and never invokes any order-placement or withdrawal endpoint — no such call exists in the codebase (balances, positions, and tickers only).

By public address only — no private keys, no seed phrases, no transaction signing exists in the product.

A manager can hand-enter a position (bonds, private/illiquid holdings, real assets, or anything else with no automated feed) directly in the dashboard. These positions carry no custody or transfer relationship at all — they price via manager-entered manual fair-value marks, which route through the same maker-checker dual-control approval workflow as any other manual mark before they can affect NAV.

4. Information Security

Role-based: fund owner and invited managers; investors are separate invite-only accounts with hard separation. Founder-admin surfaces are gated by a fail-closed allowlist. A dual-control (maker-checker) approval workflow is available for sensitive fund actions, with payload integrity re-verification at approval time.

TLS on all endpoints; HSTS (2-year max-age, includeSubDomains).

Provider-managed database encryption (Supabase), plus application-layer AES-256-GCM envelope encryption on all venue API credentials, with versioned ciphertext and non-destructive key rotation.

Secrets are held in the hosting platform's encrypted environment store; credentials are encrypted before database write; only a truncated hint of any key is ever derivable; secrets are never logged or returned by any API.

TOTP MFA is mandatory for every account type — manager, developer, and investor — enforced at the web application via an enrollment wall before any protected surface (including the LP portal) is reachable, with step-up re-verification on sensitive exports and money-adjacent actions once enrolled. API-key and mobile surfaces rely on step-up (for an already-enrolled factor) plus key auth, not the web enrollment wall itself.

Every mutating operation runs the same ordered chain before it writes: authenticate the caller, require the second factor, apply a rate limit (token-minting operations such as investor invitations carry a stricter ceiling), prove the caller owns the target fund, and scope the write itself with a fund predicate plus a matched-row check, so an operation naming another fund's record returns "not found" rather than a silent no-op success. Row-level security on every table is a further independent layer beneath this.

A user cannot change their own account type, which is the field governing which authentication rules apply. This is enforced by a database trigger rather than by a policy on a single table or a check in a single code path, so it binds on every write route including any added later. Honest scope: this closes the self-service path; the database owner and the platform service identity retain the ability, because provisioning and support require it.

5. Data Protection

Nyx Labs Ltd is a UK company registered with the Information Commissioner's Office (data protection fee paid) and processes client data in accordance with UK GDPR.

Client data is stored at rest in the EU: the production database and storage (Supabase) run in AWS eu-central-1 (Frankfurt, Germany). The application layer (Vercel serverless) is globally distributed, and some sub-processors listed in Section 7 operate in the United States.

Venue credentials are deleted immediately on disconnection. Ledger and audit-trail data is retained for the fund's life plus 7 years by design, in an append-only, database-enforced immutable store.

On account closure, client data is deleted within 30 days, except ledger and audit-trail records, which are retained for the life of the fund plus 7 years in an append-only, database-enforced store. The deletion process is currently manual (no self-serve flow); the commitment is set out in the adopted Data Retention & Disposal Policy.

6. Infrastructure & Hosting

Vercel Pro (serverless application hosting) plus Supabase Pro (managed Postgres, auth, and storage, Frankfurt, Germany). No self-managed servers.

7. Sub-Processors

See the two tables below: sub-processors that process client data (Table A), and utility APIs that receive no client personal data (Table B).

8. BCP / DR

The production database and file storage run on Supabase Pro (Frankfurt, Germany), confirmed by the founder against the live plan tier. Point-in-time recovery (PITR) was enabled by the founder on 6 August 2026: the provider continuously archives write-ahead logs, giving roughly two-minute recovery granularity within a 7-day retention window. Exchange and wallet position data is re-derivable from the connected venues on re-sync; the append-only ledger and manually-entered records depend on these backups.

Enabled (6 August 2026), as the Supabase PITR add-on with a 7-day retention window. Recovery granularity is approximately two minutes (WAL archival cadence), replacing the previous daily-backup-only posture.

RTO target: 24 hours for service restoration — the application is redeployable from source, with no server-side state outside the managed database. RPO: approximately two minutes, bounded by the provider's write-ahead-log archival cadence under point-in-time recovery, within a 7-day recovery window. Stated per the adopted Business Continuity & DR Policy, updated 6 August 2026 to match the enabled PITR capability, which requires the active backup capability to be checked and stated accurately, not assumed.

Nyx is a monitoring/reporting layer — an outage never impairs the client's access to their own funds at their venues, and the client's administrator remains the book of record.

9. Change Management & SDLC

All changes go through pull-request review. Hosted CI runs typecheck, lint, and the full automated test suite (sharded four ways) on every pull request and every push to main. Since 7 August 2026 these are enforced merge gates, not advisory checks: branch protection on the default branch requires all six checks to pass, requires the branch to be up to date before merging, and applies to administrators as well, so no one can push to or merge into the default branch while a check is failing. Force-pushes and branch deletion are blocked and linear history is required. A 25-entry engineering invariant registry has mechanical enforcement hooks that fail the build on the concrete violation shapes of the highest-severity rules. Database migrations are founder-gated with post-apply verification.

7,723 automated tests across 589 test files, as measured on 7 August 2026 (7,720 passing, 3 skipped pending environment credentials). Coverage is not only behavioural: a subset are guarantee tests that fail the build when documentation and code diverge — for example, if a shipped product module is missing from the client-facing documentation, or if that documentation hardcodes a coverage figure instead of reading the single source those figures come from.

10. Incident Response

An incident-response policy and runbook are formally adopted (24 July 2026). Security-relevant events are recorded to an append-only internal event stream. Access-review and security-event evidence exports are available.

dev@nyxsuite.com

11. Insurance

No. Neither professional indemnity nor cyber-liability cover is currently bound.

12. Certifications & Audit

No.

No.

No.

13. Key Personnel & Key-Man Risk

NYX Suite is currently built and operated by a single founder.

14. Financial Standing

Nyx Labs Ltd is an early-stage, founder-funded company. The cost base is deliberately small (managed cloud infrastructure, no premises, no payroll beyond the founder). Further financial information is available to prospective clients on request.

15. References

Not yet — there are no referenceable production clients today. Early design-partner references will be offered as they come online. In the meantime, the product itself is the reference: the codebase and controls described in these documents can be walked through live in a diligence call.