Trust & Infrastructure
Security & Compliance
Our engineering architecture, defensive controls, and operational standards designed to protect client systems and confidential data.
Enterprise Engineering Governance
Security is not an afterthought at NEXACT; it is an architectural prerequisite. We build client software and data pipelines with defense-in-depth principles, strict role boundaries, and zero speculative surface area.
1. Application & Data Security Architecture
Our modern cloud architecture eliminates traditional vector risks by adopting zero-trust paradigms at every tier:
- Postgres Row-Level Security (RLS): In our database tier, security policies are executed directly inside PostgreSQL engine kernel. Every query enforces role, tenant, and project boundaries, eliminating accidental cross-tenant data leaks even if an application endpoint were compromised.
- Private Object Storage (Cloudflare R2): Client assets are stored in private, non-public cloud buckets. Files are delivered exclusively via cryptographically signed, short-lived URLs (valid for 5 to 15 minutes) issued only after authenticated role verification.
- Server-Side Execution: All privileged database credentials, API secrets, and encryption keys reside strictly on the server or in hardened edge runtimes. No sensitive tokens are exposed to client-side JavaScript bundles.
- Transport Layer Security (TLS 1.3): All HTTP traffic is secured with modern cipher suites and HTTPS enforcement with HSTS preloading.
2. Cyber Essentials+ Alignment
NEXACT aligns its engineering workstations, CI/CD pipelines, and cloud environments with the five core technical control themes specified by the UK National Cyber Security Centre (NCSC):
Boundary Firewalls & Edge Protection
Cloudflare Web Application Firewall (WAF) mitigates volumetric DDoS attacks, automated exploit crawlers, and SQL injection probes before requests reach origin servers.
Secure Configuration
Infrastructure-as-code principles ensure default passwords are eliminated, unnecessary network ports are closed, and security headers are enforced globally.
Access Control & Least Privilege
MFA is mandatory across all developer tools, production databases, and cloud dashboards. Team members receive only the minimum access needed for their role.
Patch & Vulnerability Management
Automated dependency audits (Dependabot, npm audit, Snyk) run continuously against repository pull requests to prevent vulnerable package ingestion.
3. Data Privacy & Cryptography
Personal and business data is handled in strict compliance with the UK GDPR and Data Protection Act 2018:
- Encryption at Rest: All database disks and object buckets are encrypted using industry-standard AES-256 encryption.
- Data Minimisation: We collect only information strictly required for consultation scoping and contractual delivery.
- Isolated Test Environments: Staging and development environments never contain live production user credentials or sensitive customer financial information.
Review our full Privacy Policy and Cookie Policy for data subject rights and retention timelines.
4. Vulnerability Disclosure Policy
We welcome reports from independent security researchers, clients, and technical evaluators who discover potential security vulnerabilities in our platforms.
If you believe you have discovered a vulnerability:
- Notify our engineering team immediately at [email protected].
- Provide detailed steps to reproduce the issue, including request payloads and system conditions.
- Give us reasonable time to investigate and deploy a remediation before disclosing details publicly.
We operate under safe harbor principles: we will not pursue legal action against researchers conducting bona-fide, ethical security research that does not compromise user data, disrupt system availability, or extort fees.
Security Contacts
For security inquiries, audit requests, or compliance questionnaires:
Security Operations · NEXACT LTD
Email: [email protected]
General Studio: [email protected]