Security overview

A summary of the technical and organisational measures we apply to protect Nextelio and our customers. For a formal treatment, see our Data Processing Addendum. For anything not covered here, write to security@nextelio.io.

Encryption

• In transit. All traffic to our products is served over HTTPS with TLS 1.2 or above. HSTS is enabled. Older cipher suites are disabled at the edge.
• At rest. Databases are encrypted at rest by the provider (Neon, AES 256 GCM). WhatsApp Business Account access tokens, and any comparable third party secret, are application layer encrypted with AES 256 GCM before storage, using envelope encryption with a key stored outside the database.
• Keys. Encryption keys are held in the platform secret store, rotated on a documented schedule and never checked into source control.

Authentication

• Password based authentication uses a modern hashing algorithm with a per user salt. We enforce a minimum length and check against known compromised password lists.
• OAuth via Google is available and recommended. Multi factor authentication is available and enforceable at the workspace level.
• Session cookies are HttpOnly, Secure and SameSite. Session invalidation on password change, sign out or admin action.
• Meta’s Embedded Signup is used for WhatsApp Business Account onboarding. Tokens returned by Meta are not shown to staff and are encrypted before storage.

Authorisation and isolation

• Multi tenant with strict workspace isolation. Every query enforces the workspace boundary at the application layer.
• Role based access inside a workspace: owner, admin, editor, viewer.
• Least privilege for internal access. Production access is restricted, logged and reviewed.

Data handling

• Data residency: EU (Frankfurt) by default for storage. Compute is pinned to the same region for warm latency.
• Backups: automated, encrypted, retained on a rolling window of no more than 90 days.
• Data deletion: see our Data Deletion page. Encrypted tokens are removed within 24 hours of workspace disconnection.

Application security

• Dependency vulnerabilities scanned continuously.
• Type safe codebase (TypeScript across web and server) with static analysis in continuous integration.
• Automated tests run before every deployment.
• Content Security Policy and standard HTTP security headers.

Infrastructure

• Hosting on Vercel with regional pinning.
• Managed PostgreSQL on Neon.
• Third party services listed on the Sub-processors page.
• Secrets in the platform secret store, scoped per environment.

Logging and monitoring

• Structured application logs with correlation identifiers. Access to logs is restricted and audited.
• Alerting on error rates, latency spikes and authentication anomalies.
• Audit trail for sensitive workspace events (member invited, role changed, WABA disconnected, account deleted).

Incident response

• Documented runbook for security incidents. On call rotation for production issues.
• Personal data breaches are notified to affected customers without undue delay, and within 48 hours of confirmation.
• Post incident reviews are shared with affected customers on request.

Vulnerability disclosure

If you have discovered a vulnerability, please tell us before disclosing publicly. Email security@nextelio.io. We investigate every report and reply within one working day. We do not initiate legal action against researchers who follow this policy in good faith.

Third party audits and certifications

We do not currently hold a formal certification (SOC 2, ISO 27001, etc.). We are working toward one and will publish the report here when it is issued. For enterprise customers, we complete security questionnaires and share our internal documentation on request.