Security and data isolation
Nexora is built with secure defaults. We describe what we implement — we do not claim certifications we have not obtained.
Organization isolation
Every business record carries an organization id, and every query is scoped to the caller's organization at the data-access layer. There is no route that returns another organization's intelligence or documents.
Authentication
Sessions are httpOnly cookies issued server-side and expired automatically. Passwords are stored as salted PBKDF2-SHA256 derivations, never in plain text. No token is ever returned to the browser in JSON.
Authorization
Roles are Owner, Admin, Member and Viewer, enforced server-side on every mutating endpoint rather than hidden in the interface.
Secret management
Provider keys live in server-side configuration only. No API key is ever shipped to the browser, and model calls originate from the backend.
Input and output handling
Request bodies are validated against strict schemas. Source content is stripped of markup and bounded before reaching a model. Errors returned to users are safe messages — never stack traces.
Audit logging
Signups, Business Brain edits, competitor and target changes, scans, analyst usage and plan changes are written to an append-only audit log scoped to your organization.
Not yet claimed
We have not obtained SOC 2, ISO 27001 or any other certification, and we do not claim GDPR compliance as a certified status. The platform is designed with privacy principles in mind; legal review is required before commercial launch.