Enterprise / technical evaluation
Evaluate NEES Governance Platform
NEES is currently a Free Developer Preview, not enterprise production general availability. This page helps technical and security reviewers plan a bounded proof of concept without turning unknowns into assurances.
Current assurance matrix
| Evaluation area | Status | What the public evidence supports |
|---|---|---|
| Product maturity | Verified public | Core V3 and the hosted Platform are offered as a Free Developer Preview. |
| Decision boundary | Verified public contract | Supported actions use submit, qualify and start before application-owned execution and reporting. |
| External execution | Application responsibility | ALLOW does not execute or prove an external effect; the application validates, executes and verifies. |
| Failure behavior | Documented; deployment test required | Missing, stale, denied or unavailable governance must fail closed; uncertain effects require reconciliation. |
| Evidence / receipts | Reviewable supported records | No public claim of cryptographic signing, immutable storage or independent audit. |
| Free quotas | Published; complete boundary acceptance pending | 1,000 new submissions per UTC month and 30 authenticated Runtime requests/minute per organization. |
| Production SLA / benchmark | Not publicly specified | No uptime, latency or throughput guarantee is published. |
| Retention / residency / subprocessors / DPA | Not publicly specified | No detailed enterprise data-handling assurance is published on this site. |
| Embedded / customer-managed mode | Documented separately; access unverified | PyPI describes separately licensed or provided Core access. It is not part of the standard package or Free Preview entitlement; availability and terms require direct verification. |
| Certifications / independent pentest | Not asserted | No SOC 2, ISO 27001 or independent penetration-test certification is claimed. |
Public data flow and responsibility boundary
- A trusted application backend submits a registered action and version-bound assessment to a compatible Runtime.
- NEES evaluates supported published facts and returns a governance result.
- The application enforces that result, re-checks the live target, protects external credentials and performs any effect.
- The application verifies the result, reports truthfully and reconciles supported records with its own observation.
- The Control Plane and Dashboard configure or resolve governance; they are not action-execution stages.
Bounded proof-of-concept plan
- Choose one harmless, reversible or non-side-effecting supported action and define the real actor, resource, operation and scope.
- Use an isolated development environment and dedicated test credentials; keep all secrets server-side.
- Record the SDK or connector version and resolve the existing assessment without publishing a replacement baseline.
- Test allowed, denied, stale, unavailable, target-mismatch and uncertain-outcome paths.
- Verify that no external effect occurs on denial or unavailable governance, and that reporting matches the application-observed result.
- Document every unanswered requirement before considering consequential or production use.
Questions to resolve before production
- Which exact Runtime, connector and schema revision will the deployment use?
- How are tenant identity, Runtime credentials, rotation and least privilege handled in that deployment?
- What retention, deletion, residency and subprocessor terms apply to the intended data?
- What availability, incident response, support and commercial terms—if any—are agreed in writing?
- How will uncertain external effects be reconciled without unsafe automatic retry?
- Which internal and independent security reviews are required by the evaluator?
Next steps
Developers can start with the self-service Free Preview. Use the separate inquiry form to discuss a custom integration; the form is not a purchase flow and does not promise production access, enterprise support or commercial terms.