> ## Documentation Index
> Fetch the complete documentation index at: https://learn.nextedy.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Overview

> How Nextedy protects your data — security architecture, compliance, incident response, and privacy practices.

export const LastReviewed = ({date}) => {
  if (!date) return null;
  const formatted = new Date(`${date}T00:00:00Z`).toLocaleDateString("en-US", {
    year: "numeric",
    month: "long",
    day: "numeric",
    timeZone: "UTC"
  });
  return <p className="mt-10 text-sm text-gray-400 dark:text-zinc-500 not-prose">
      Last reviewed on {formatted}
    </p>;
};

Nextedy products run inside the Siemens Polarion ALM application server. They share the same JVM process, the same authenticated session, and the same data storage as Polarion itself. This architecture means that Nextedy does not introduce a separate attack surface — security controls are inherited directly from the Polarion platform.

## Core Principle: Inherited Security

Nextedy products do not maintain their own databases or authentication systems. While the products expose their own REST endpoints, these endpoints are accessible only within the Polarion server perimeter and are protected by Polarion's authentication and session management. Every operation executes within the security context of the currently authenticated Polarion user. The practical consequence is that the security posture of a Nextedy deployment is determined by the security posture of the underlying Polarion installation.

This leads to a clear responsibility model:

| Responsibility                                                     | Owner                                                 |
| ------------------------------------------------------------------ | ----------------------------------------------------- |
| Secure product code, dependency management, vulnerability scanning | **Nextedy**                                           |
| Polarion platform security, authentication, encryption, backup     | **Customer** (on-premise) or **Siemens** (Polarion X) |
| User provisioning, access control policies, project permissions    | **Customer**                                          |

## Deployment Modes

Nextedy products support both deployment models offered by Polarion:

* **On-premise** — The customer manages the entire Polarion infrastructure, including OS, JVM, TLS certificates, backup, and network security.
* **Polarion X (SaaS)** — Siemens manages the Polarion infrastructure. Nextedy products have been cleared by Siemens IT security review for deployment on Polarion X.

## Explore This Section

<Columns cols={2}>
  <Card title="Product Security" icon="lock" href="/overview/security-and-privacy/product-security">
    Product architecture, authentication model, secure development practices.
  </Card>

  <Card title="Data Security" icon="database" href="/overview/security-and-privacy/data-security">
    Data storage, encryption, isolation, and backup.
  </Card>

  <Card title="Compliance and Assessments" icon="clipboard-check" href="/overview/security-and-privacy/compliance">
    Security assessments, certifications, and industry relevance.
  </Card>

  <Card title="Privacy" icon="eye-slash" href="/overview/security-and-privacy/privacy">
    Data processing scope, GDPR approach, and data residency.
  </Card>

  <Card title="Incident Management" icon="bell" href="/overview/security-and-privacy/incident-management">
    Security monitoring, triage, patching SLAs, and breach notification.
  </Card>

  <Card title="Supply Chain Security" icon="link" href="/overview/security-and-privacy/supply-chain">
    SBOM, third-party component tracking, and vulnerability scanning.
  </Card>
</Columns>

<LastReviewed date="2026-07-08" />