Security
This is how NXCBusiness protects each organization's information. This page describes controls that exist in the platform today.
Isolation per organization
Every record belongs to an organization. The application filters by organization and the PostgreSQL database also enforces it with Row Level Security: one organization cannot read or change another's data, even if a query fails.
Server-side permissions
Every operation validates the user's membership, role and module permissions on the server; hiding a button in the interface is never the control. Relevant changes are kept in a history with author and date.
Private files
Logos, images, documents and CVs are kept in private storage. They are only delivered through 15-minute temporary links, issued after checking permissions.
Encryption in transit and network
The site and the API are served over HTTPS behind Cloudflare. The internal AI service is not exposed to the internet: only the NXCBusiness API can call it.
What we do not offer yet
NXCBusiness is in early access: it does not have security certifications or external audits yet, nor a service level agreement. We will publish them here when they exist.
Report a vulnerability
If you find a security issue, write to us at [email protected] or use the contact form. Do not access third-party data or disrupt the service while investigating; we will reply as soon as possible.
More details about data processing in the privacy policy.