Security
Isolation and permission are code, not settings.
NXTA is multi-tenant, so the first security question is whether one company can see another. The answer is enforced in the data layer and the request pipeline, and tested in the build — not documented in a policy.
Controls that are live
Tenant isolation on every read and write
Every company-scoped model passes through a Prisma extension that binds the caller’s company. A by-id write also filters on the owner and answers 404 — never 403 — so a foreign id does not confirm a row exists. Raw SQL carries its own company predicate because it bypasses the extension.
Authorization is decided on the server
Navigation, tabs and controls come from a server-built manifest. A control the caller cannot use is not sent to the browser, so hiding it is not the security boundary. Every route names the capability it enforces.
Every change is audited
Writes go through an audit trail, including platform-owner impersonation. A closed accounting period is not editable; a correction is a reversal entry that references the original, so history stays intact.
Three-step sign-in
Every account proves a password, then a six-digit code or a single-use magic link on each new device. An account holding platform authority also proves a time-based authenticator code. Trusted devices expire after 30 days and are revoked by a password reset.
Backups that leave the box
A nightly PostgreSQL dump is verified with pg_restore before it is promoted, checksummed, retained for 14 days and copied off the server when a remote target is configured. The deploy takes its own dump before a migration.
Secrets are not in the repository
Runtime secrets live in a server-side environment file that deployment does not manage. Encrypted system settings use a dedicated key. The repository is private and production moves only by deploying a tagged commit.
What we do not claim
A security page is only useful if it is accurate. These are deliberately absent:
- No SOC 2 or ISO 27001 certification. We have not completed an audit.
- No third-party penetration-test report. One is planned before an enterprise sale.
- No uptime SLA. A status page and a real history come first.
- No claim that data is encrypted at rest beyond what the hosting provider does by default.
- No claim of a specific data-residency region unless it is stated in your order.
If your procurement process needs a security questionnaire, a DPA or a specific control, write to us and we will answer in writing.
We would like to measure how the public site is used, so we can improve it. This loads Google Analytics on marketing pages only — never inside a workspace. You can decline and still use the site.