Security Overview

Infrastructure

The Nexolve application runs on Vercel (SOC 2 Type II, ISO 27001). All assessment and report data is stored in Supabase Postgres, hosted in the EU West region (SOC 2 Type II, ISO 27001, GDPR-compliant). Neither Nexolve nor its staff have direct access to your Stripe billing information — all payment processing is handled entirely by Stripe (PCI DSS Level 1).

Encryption

• In transit — all connections use HTTPS/TLS. HTTP is automatically redirected to HTTPS via Vercel.
• At rest — all data in Supabase Postgres is encrypted at rest using AES-256.
• Payment data — card details never pass through Nexolve infrastructure; they are tokenised client-side by Stripe.js.

Access controls

• Database access requires authenticated service-role credentials stored exclusively in Vercel environment variables — never committed to source code.
• Row-Level Security (RLS) is enabled in Supabase, ensuring each agency's data is isolated and accessible only to authorised requests.
• All API keys and secrets are rotated on a quarterly schedule.
• Administrative access to infrastructure (Supabase, Vercel, Stripe) is protected by multi-factor authentication.

AI and LLM security

• Your assessment data is sent to Anthropic (claude-sonnet-4-6) solely to generate your report. It is not used to train AI models.
• LLM API calls are routed via Vercel AI Gateway. We target zero data retention on the gateway — request/response bodies are not logged beyond what is required for error diagnosis.
• We do not share your data with any AI provider beyond what is necessary to generate your personalised report.

Backups and recovery

• Supabase Pro tier provides point-in-time recovery (PITR) with up to 7 days of backup history.
• Daily automated backups are retained by Supabase. Recovery is tested quarterly.

Incident response

In the event of a data breach affecting personal data, we follow a documented incident response process: detect, contain, assess, and notify affected individuals and the ICO within 72 hours where required by UK GDPR (Article 33). Customers whose data is involved will be notified directly by email.

Penetration testing and audits

We rely on the SOC 2 Type II and ISO 27001 certifications of our infrastructure providers (Vercel, Supabase, Stripe) for third-party assurance. Application-level penetration testing is planned as the customer base scales. Enterprise customers requiring a specific security review are welcome to contact us.

Responsible disclosure

If you discover a security vulnerability in Nexolve, please report it to vincent@nexolve.co.uk. We aim to acknowledge reports within 48 hours and resolve confirmed issues within 30 days.