Security you can check.
Nexovil isolates each organisation's data at the database with Row Level Security, encrypts traffic with TLS 1.2 or higher, stores only hashes of signing tokens, and protects its admin console with MFA. This page describes what is implemented, in plain English, and states the limits.
- TLS 1.2 or higherEvery connection is encrypted in transit.
- 256-bit tokensSigning, quote and invite links, stored only as hashes.
- Nightly backupsEncrypted, with the key held offline.
- MFA on adminThe platform console needs an authenticator code.
Tenant isolation
Every customer's data lives in the same database, but it is isolated by Row Level Security. A signed-in user can only see rows that belong to their own organisation. The database enforces this, not just the application code, so a bug in the app cannot quietly widen access.
What it means for you: Another rental business cannot see your customers, bookings or contracts.
Encryption
All traffic is encrypted in transit with TLS 1.2 or higher. Data is encrypted at rest by our database provider. Credentials for third-party integrations are encrypted with AES-GCM 256 before they touch the database.
What it means for you: Data is protected on the wire and on disk.
Backups
Database backups run nightly through our database provider (Supabase). Backups are encrypted at rest. The platform admin console shows the timestamp of the last successful backup.
What it means for you: A bad day for the database does not have to be a bad day for your records.
Signing links and tokens
Contract signing links, quote links and invitations use 256-bit tokens. Only the hash of each token is stored, so a leaked database dump does not yield usable links. Signing links are single-use and expire.
What it means for you: An old link cannot be replayed to sign or accept something.
Signed contracts as evidence
A signed contract PDF is stored with its SHA-256 hash, the signing time, and the IP address and user agent recorded at signing. If the file is changed later, the hash no longer matches, which makes tampering detectable.
What it means for you: You can show what was agreed, and prove the file has not been altered.
Authentication
Passwords require 12 characters. Email verification is mandatory. You can sign in with Google or with a one-time passcode (OTP). Bot protection guards signup, login, password reset and contract signing. The platform admin console requires an authenticator code (TOTP MFA).
What it means for you: Accounts are harder to guess, phish or script against.
How we protect accounts and data
These are the controls that are built into Nexovil today. Each one is implemented and running.
Passkeys instead of passwords
You can sign in with Face ID, Touch ID, Windows Hello or a hardware key like a YubiKey. No password to type, steal or reuse. Passkeys are stored on your device and never leave it. You can still use a password if you prefer.
What it means for you: Phishing and credential stuffing attacks do not work against passkeys.
Device checks at signup
When someone creates an account, Nexovil checks the device and browser. Known bad actors and automated signups are blocked before a trial starts. This stops people from creating dozens of trial accounts.
What it means for you: Trial accounts come from real people, not bots.
Password breach check
If you choose a password, Nexovil checks it against a database of hundreds of millions of passwords found in public data breaches. If your password is on that list, you cannot use it. The check is private and your password is never sent to the breach database.
What it means for you: You cannot accidentally use a password that attackers already know.
Encryption keys rotate
The keys used to encrypt sensitive data are rotated on a schedule. If a key is ever compromised, only data encrypted with that key is at risk. Older data is re-encrypted with the new key.
What it means for you: A key leak today does not expose yesterday data.
Audit trail you can verify
Every important action is logged. Each log entry is linked to the one before it, so the chain cannot be edited without detection. You can review who did what and when.
What it means for you: You can prove what happened and when, even months later.
Support without passwords
If you contact support, the support team can view your account to help you. They never see your password and cannot change it without your involvement. Every support session is logged.
What it means for you: Getting help does not mean giving up account security.
Sub-processors
Nexovil uses these providers to run the service. They process data on our behalf under the terms of our Data Processing Agreement.
| Provider | What it does |
|---|---|
| Cloudflare | Hosting, DNS and content delivery |
| Supabase | Database, authentication and file storage |
| Lemon Squeezy | Subscription billing and payment processing |
| Maileroo | Transactional email delivery |
We update this list before adding a new sub-processor that handles customer data.
Your data stays under your control
Security is also about what happens to your records over time.
Export any time
CSV export of items, customers and bookings is included on every plan. After a trial ends without a plan, you keep 30 days to export.
Delete when you leave
If you delete your account, personal information is deleted or anonymised within 30 days, unless the law requires us to keep it. See the Privacy Policy.
Never sold, never used for AI
Nexovil does not sell personal information and does not use your data to train AI models. Read the data promise.
What we do not claim
Nexovil does not hold SOC 2, ISO 27001, HIPAA or PCI DSS certification. No software is unhackable or free of bugs. We test, we log and we fix. If you find a problem, please tell us at security@nexovil.us.ci. We read every report.
If your own security review needs more detail, write to security@nexovil.us.ci and we will answer what we can.
Security questions
Is Nexovil SOC 2, ISO 27001, HIPAA or PCI DSS certified?
No. Nexovil does not claim those certifications. Card payments are handled by Lemon Squeezy, and Nexovil does not store full payment card numbers.
How do I sign in?
With your Google account or with a one-time passcode (OTP). Email verification is mandatory, and bot protection guards signup, login and password reset.
What happens to my data if I cancel?
If a trial ends without a plan, the account becomes read-only and you keep 30 days to export everything to CSV. If you delete your account, personal information is deleted or anonymised within 30 days, unless the law requires us to keep it.
Do you sell my customers' data or use it to train AI?
No to both. Nexovil does not sell personal information and does not use customer data to train AI models. The providers listed above process data on our behalf, under our Data Processing Agreement.
How do I report a vulnerability?
Email security@nexovil.us.ci with what you found, where, and the steps to reproduce it. We read every report and reply by email.
See it for yourself.
Start the 14-day trial with full Pro access and no card. Your data can be exported at any time.