Security at NexusAI Gear
Trust is a product feature, so we treat security as part of the build rather than a page at the end of a sales deck. This page describes the controls we run, the standards we work toward, and how to tell us when something is wrong.
Overview
Four commitments we can be held to
Every one of these applies to our hosted products and to the platforms we build for clients, because we use the same engineering and access standards in both.
Encrypted end to end
TLS 1.3 in transit and AES-256 at rest for every store we operate, including backups and object storage.
Least privilege
Multi-factor authentication for staff, hardware-key support for production access, and quarterly access reviews.
Secure by design
Threat modelling, code review, automated scanning, and dependency patching in every release we ship.
Findable and fixable
A published disclosure programme, coordinated remediation, and annual third-party penetration tests.
Security Practices
What we actually run, day to day
| Domain | Control | Cadence |
|---|---|---|
| Encryption in transit | TLS 1.2 or higher enforced across all endpoints, with HSTS and automated certificate renewal | Continuous |
| Encryption at rest | AES-256 on databases, object storage, queues, and backups, with per-environment keys | Continuous |
| Key management | Customer-managed keys available on Enterprise plans; rotation every 90 days | Quarterly |
| Authentication | SSO via SAML 2.0 and OIDC, SCIM provisioning, enforced MFA for all staff | Continuous |
| Authorisation | Role-based access control, per-space roles in Docs, page-level locks, workspace guest expiry | Continuous |
| Access reviews | Production access reviewed and re-certified; stale accounts disabled automatically | Quarterly |
| Logging and monitoring | Centralised logs with anomaly alerting, admin action audit trails, 24-month retention on security logs | Continuous |
| Dependency scanning | Software composition analysis, secret scanning, and container image scanning in CI on every commit | Per commit |
| Static analysis | SAST and linting gates in the pipeline; unresolved critical findings block release | Per commit |
| Code review | Two approvals required for changes touching authentication, billing, or data handling paths | Per pull request |
| Penetration testing | Third-party web application and API testing, plus an internal review of AI-specific attack surfaces | Annual |
| Incident response | Documented severity matrix, 24-hour response target, customer notification within 72 hours of confirmed impact | Tested quarterly |
| Backups | Encrypted daily snapshots, 30-day point-in-time recovery, and restore drills | Daily / quarterly drill |
| Vendor management | Security review of sub-processors before onboarding and annually thereafter | Annual |
| Staff training | Secure development and phishing awareness training with simulated phishing exercises | Annual |
| Business continuity | Documented continuity plan with recovery time and recovery point objectives, exercised annually | Annual |
Data Protection
Where your data lives, and how it stays yours
Encryption in transit and at rest
All traffic to our application and API endpoints runs over TLS 1.2 or higher with HSTS enabled. Data at rest - databases, object storage for uploads and generated media, message queues, and backups - is encrypted with AES-256 under keys separated by environment. Customer-managed keys are available on Enterprise plans, and internal keys rotate every 90 days.
AI data handling
Your prompts, uploaded files, and generated outputs are never used to train shared or public models. They are routed to inference providers under contracts that restrict retention and training use, with zero-retention endpoints where available. Enterprise customers can pass a dedicated provider key so inference never touches our shared project. Full detail is in our Privacy Policy.
Access control and SSO
Every staff member uses multi-factor authentication, and production access requires a hardware security key plus a just-in-time approval. For customers, we support SAML 2.0 and OIDC single sign-on, SCIM 2.0 provisioning and de-provisioning, role-based workspace permissions, guest accounts with expiry dates, and creator submission review in NexusAI Docs.
Retention and resilience
Data is deleted on the schedule published in our Privacy Policy, with deleted content removed from primary systems within 30 days and from backups within 90 days. Backups are encrypted, retained for point-in-time recovery for 30 days, and restore procedures are rehearsed every quarter.
Secure Development
How a line of code earns its way to production
Threat modelling
Every new service or major feature gets a threat model before build, covering authentication, authorisation, data flows, and abuse cases.
Peer review
Two reviewers approve every change, and changes to auth, billing, or data handling need a second reviewer from outside the authoring team.
Automated gates
Dependency scanning, secret scanning, SAST, and container scanning run on every commit. Critical findings block the merge.
Red team reviews
Before major launches we review prompt injection, data exfiltration, and cross-tenant access paths specifically, not just generic web risks.
Compliance
Where we stand today, honestly labelled
We would rather show you an audit in progress than a badge we have not earned yet.
SOC 2 Type II
In progress. Our control framework is defined and the observation period has begun; the report is expected in 2026. Ask us for the current status and our readiness summary.
GDPR aligned
Data processing agreements, standard contractual clauses, a documented lawful basis, and a sub-processor list. We are not certified against the EU AI Act.
PIPEDA compliant
We collect, use, and disclose personal information consistent with Canada's private sector privacy law, including meaningful consent and access rights.
PCI DSS via Stripe
Card data is handled entirely by Stripe, a PCI DSS Level 1 certified processor. NexusAI Gear never stores full card numbers on its systems.
Report a vulnerability
If you believe you have found a security issue in any NexusAI Gear product, we want to hear about it, and we do not punish people who tell us in good faith. Send the details to security@nexusaigear.com, including the affected endpoint, reproduction steps, and any proof-of-concept material. Please encrypt sensitive reports using the key published on request, and allow us reasonable time to fix the issue before public disclosure.
- You will get an acknowledgement within one business day.
- We will confirm the finding and share a severity rating and remediation plan.
- Critical and high severity issues are targeted for a fix within 30 days of confirmation.
- We will credit you in our advisories if you would like to be named.
- Good-faith research is welcome: no automated scanning, no denial of service, and no access to other customers' data.
Get in touch
Security is a conversation, not a form
Vulnerability reports
security@nexusaigear.com - monitored daily, acknowledged within one business day.
Security questionnaires
hello@nexusaigear.com - ask for our current security packet, sub-processor list, and penetration test summary.
Incident notification
hello@nexusaigear.com - suspected incidents affecting your data, flagged with "SECURITY" in the subject line.