Vendor Due Diligence Questionnaire
Answers to the standard vendor and operational due-diligence questions LPs and allocators ask before onboarding a fund-ops platform.
1. Company Information
Nyx Labs Ltd, a private limited company registered in England and Wales. Pre-seed stage; the product is live in production at nyxchain.org.
Nyx Labs Ltd
16842575
10 November 2025
100% founder-owned.
One — the founder. See Section 13, Key Personnel & Key-Man Risk.
5 Bisham Court, Bisham, Marlow, England, SL7 1SD
2. Product & Scope
Nyx Fund is software — an LP reporting and portfolio monitoring platform. The client's fund administrator's NAV remains the official NAV of record; Nyx produces a shadow NAV that reconciles against it, using a detect-and-reconcile model, never a write-time lock.
What Nyx Fund is NOT:
- →Not a fund administrator
- →Not a custodian
- →Not an investment adviser
- →Not a broker
The administrator's NAV remains official at all times.
3. Access to Client Assets
No. Nyx never has custody or transfer capability. Exchange connections use API credentials the client supplies; the platform requests read-only keys and never invokes any order-placement or withdrawal endpoint — no such call exists in the codebase (balances and tickers only).
By public address only — no private keys, no seed phrases, no transaction signing exists in the product.
4. Information Security
Role-based: fund owner and invited managers; investors are separate invite-only accounts with hard separation. Founder-admin surfaces are gated by a fail-closed allowlist. A dual-control (maker-checker) approval workflow is available for sensitive fund actions, with payload integrity re-verification at approval time.
TLS on all endpoints; HSTS (2-year max-age, includeSubDomains).
Provider-managed database encryption (Supabase), plus application-layer AES-256-GCM envelope encryption on all venue API credentials, with versioned ciphertext and non-destructive key rotation.
Secrets are held in the hosting platform's encrypted environment store; credentials are encrypted before database write; only a truncated hint of any key is ever derivable; secrets are never logged or returned by any API.
TOTP MFA is supported, with step-up enforcement on authenticated surfaces and re-verification on sensitive exports and money-adjacent actions.
5. Data Protection
Nyx Labs Ltd is a UK company registered with the Information Commissioner's Office (data protection fee paid) and processes client data in accordance with UK GDPR.
Client data is stored at rest in the EU: the production database and storage (Supabase) run in AWS eu-central-1 (Frankfurt, Germany). The application layer (Vercel serverless) is globally distributed, and some sub-processors listed in Section 7 operate in the United States.
Venue credentials are deleted immediately on disconnection. Ledger and audit-trail data is retained for the fund's life plus 7 years by design, in an append-only, database-enforced immutable store.
On account closure, client data is deleted within 30 days, except ledger and audit-trail records, which are retained for the life of the fund plus 7 years in an append-only, database-enforced store. The deletion process is currently manual (no self-serve flow); the commitment is set out in the adopted Data Retention & Disposal Policy.
Export formats available today:
- →CSV — journal, trial balance, general ledger, access review, security events
- →Tax cost-basis CSV
- →Form PF data handoff
- →PDF reports and statements
- →PPTX
6. Infrastructure & Hosting
Vercel (serverless application hosting) plus Supabase (managed Postgres, auth, and storage). No self-managed servers.
7. Sub-Processors
See the two tables below: sub-processors that process client data (Table A), and utility APIs that receive no client personal data (Table B).
Table A — process client data:
| Sub-processor | What it receives / does |
|---|---|
| Supabase | Database, auth, storage — all customer data |
| Vercel | Hosting |
| Stripe | Billing; card data via Stripe Checkout only — never touches Nyx |
| Resend | Transactional email |
| Anthropic | AI text generation on redacted context — fund names, personal names, and wallet addresses stripped before any prompt leaves the platform; redaction is fail-closed |
| OpenRouter | AI fallback, same redacted context |
| Alchemy | Blockchain data — receives wallet addresses, pseudonymous |
| ElevenLabs | Text-to-speech on post-redaction output |
| SnapTrade | Read-only brokerage aggregation |
| cron-job.org | Schedule trigger service — holds a scoped trigger secret only, no client data access |
| GitHub | Source code hosting |
Table B — utility APIs, no client personal data:
| Sub-processor / API | Role |
|---|---|
| CoinGecko | Pricing |
| Yahoo Finance | Pricing |
| Finnhub | Pricing |
| TronGrid | Chain data |
| mempool.space | Chain data |
| Public chain RPCs (Solana / Sui / Aptos / Bitcoin) | Chain data |
| WalletConnect | Wallet connection |
| Cal.com | Scheduling |
| Telegram / Discord / Slack / WhatsApp | Chat-platform integrations, only when a client connects them |
8. BCP / DR
No scheduled database backups exist today: the production database runs on an infrastructure tier that does not include them (verified against the live configuration, 24 July 2026). Enabling scheduled daily backups is the standing remediation item — no date committed. Exchange and wallet position data is re-derivable from the connected venues on re-sync; the append-only ledger and manually-entered records depend on database backups.
Not enabled.
RTO target: 24 hours for service restoration — the application is redeployable from source, with no server-side state outside the managed database. RPO: currently undefined, because no scheduled backups exist (see above); a 24-hour RPO becomes the commitment once scheduled backups are enabled. Stated per the adopted Business Continuity & DR Policy (24 July 2026), which requires the active backup capability to be checked and stated accurately, not assumed.
Nyx is a monitoring/reporting layer — an outage never impairs the client's access to their own funds at their venues, and the client's administrator remains the book of record.
9. Change Management & SDLC
All changes go through pull-request review with typecheck, lint, and a roughly 4,800-case automated test suite as merge gates. A 25-entry engineering invariant registry has mechanical enforcement hooks. Database migrations are founder-gated with post-apply verification.
10. Incident Response
An incident-response policy and runbook are formally adopted (24 July 2026). Security-relevant events are recorded to an append-only internal event stream. Access-review and security-event evidence exports are available.
dev@nyxchain.org
11. Insurance
No. Neither professional indemnity nor cyber-liability cover is currently bound.
12. Certifications & Audit
No.
No.
No.
See the Security & Compliance Roadmap for planned certification work.
13. Key Personnel & Key-Man Risk
Nyx Fund is currently built and operated by a single founder.
Mitigations that exist in the product:
- →Read-only credentials — no custody to misuse
- →Client approval on everything outbound (reports are approve-then-distribute; maker-checker)
- →Append-only ledger with reproducible NAV runs
- →Full data export in open formats at any time
- →Source code walkable in a diligence call
Continuity commitments are detailed in the Business & Data Continuity Statement.
14. Financial Standing
Nyx Labs Ltd is an early-stage, founder-funded company. The cost base is deliberately small (managed cloud infrastructure, no premises, no payroll beyond the founder). Further financial information is available to prospective clients on request.
15. References
Not yet — there are no referenceable production clients today. Early design-partner references will be offered as they come online. In the meantime, the product itself is the reference: the codebase and controls described in these documents can be walked through live in a diligence call.