Security and trust.

This page describes what Nexovil implements, in plain English, and what its limits are.

Tenant isolation

Every customer's data lives in the same database, but it is isolated by Row Level Security. A signed-in user can only see rows that belong to their own organisation. The database enforces this, not the application code.

Encryption

All traffic is encrypted in transit with TLS 1.2 or higher. Data is encrypted at rest by our database provider. Bring-your-own-key credentials for third-party integrations are encrypted with AES-GCM 256 before they touch the database.

Backups

A nightly database dump runs to private storage. It is encrypted with a key that lives only on the founder's machine and in a sealed offline copy. The platform admin console shows the timestamp of the last successful backup.

Signing and tokens

Contract signing links, quote links, and invitations use 256-bit tokens. Only the hash of the token is stored. A leaked database dump does not yield usable tokens.

Authentication

Passwords require 12 characters. Email verification is mandatory. Sign in with Google and Apple are supported. Passkeys (Face ID, Touch ID, Windows Hello) are supported. The platform admin console requires TOTP MFA.

What we do not claim

Nexovil does not claim SOC 2, ISO 27001, HIPAA, or PCI DSS certification. No software is "unhackable" or "bug free". We test, we log, we fix. If you find a security issue, email security@nexovil.us.ci.