Security you can check.
Nexovil isolates each organisation's data at the database with Row Level Security, encrypts traffic with TLS 1.2 or higher, stores only hashes of signing tokens, and protects its admin console with MFA. This page describes what is implemented, in plain English, and states the limits.
- TLS 1.2 or higherEvery connection is encrypted in transit.
- 256-bit tokensSigning, quote and invite links, stored only as hashes.
- Nightly backupsEncrypted, with the key held offline.
- MFA on adminThe platform console needs an authenticator code.
Tenant isolation
Every customer's data lives in the same database, but it is isolated by Row Level Security. A signed-in user can only see rows that belong to their own organisation. The database enforces this, not just the application code, so a bug in the app cannot quietly widen access.
What it means for you: Another rental business cannot see your customers, bookings or contracts.
Encryption
All traffic is encrypted in transit with TLS 1.2 or higher. Data is encrypted at rest by our database provider. Credentials for third-party integrations are encrypted with AES-GCM 256 before they touch the database.
What it means for you: Data is protected on the wire and on disk.
Backups
A nightly database dump runs to private storage. It is encrypted with a key that is held offline, separately from the production systems. The platform admin console shows the timestamp of the last successful backup.
What it means for you: A bad day for the database does not have to be a bad day for your records.
Signing links and tokens
Contract signing links, quote links and invitations use 256-bit tokens. Only the hash of each token is stored, so a leaked database dump does not yield usable links. Signing links are single-use and expire.
What it means for you: An old link cannot be replayed to sign or accept something.
Signed contracts as evidence
A signed contract PDF is stored with its SHA-256 hash, the signing time, and the IP address and user agent recorded at signing. If the file is changed later, the hash no longer matches, which makes tampering detectable.
What it means for you: You can show what was agreed, and prove the file has not been altered.
Authentication
Passwords require 12 characters. Email verification is mandatory. You can sign in with Google or with a one-time passcode (OTP). Bot protection guards signup, login, password reset and contract signing. The platform admin console requires an authenticator code (TOTP MFA).
What it means for you: Accounts are harder to guess, phish or script against.
Sub-processors
Nexovil uses these providers to run the service. They process data on our behalf under the terms of our Data Processing Agreement.
| Provider | What it does |
|---|---|
| Cloudflare | Hosting, DNS and content delivery |
| Supabase | Database, authentication and file storage |
| Lemon Squeezy | Subscription billing and payment processing |
| Maileroo | Transactional email delivery |
We update this list before adding a new sub-processor that handles customer data.
Your data stays under your control
Security is also about what happens to your records over time.
Export any time
CSV export of items, customers and bookings is included on every plan. After a trial ends without a plan, you keep 30 days to export.
Delete when you leave
If you delete your account, personal information is deleted or anonymised within 30 days, unless the law requires us to keep it. See the Privacy Policy.
Never sold, never used for AI
Nexovil does not sell personal information and does not use your data to train AI models. Read the data promise.
What we do not claim
Nexovil does not hold SOC 2, ISO 27001, HIPAA or PCI DSS certification. No software is unhackable or free of bugs. We test, we log and we fix. If you find a problem, please tell us at security@nexovil.us.ci. We read every report.
If your own security review needs more detail, write to security@nexovil.us.ci and we will answer what we can.
Security questions
Is Nexovil SOC 2, ISO 27001, HIPAA or PCI DSS certified?
No. Nexovil does not claim those certifications. Card payments are handled by Lemon Squeezy, and Nexovil does not store full payment card numbers.
How do I sign in?
With your Google account or with a one-time passcode (OTP). Email verification is mandatory, and bot protection guards signup, login and password reset.
What happens to my data if I cancel?
If a trial ends without a plan, the account becomes read-only and you keep 30 days to export everything to CSV. If you delete your account, personal information is deleted or anonymised within 30 days, unless the law requires us to keep it.
Do you sell my customers' data or use it to train AI?
No to both. Nexovil does not sell personal information and does not use customer data to train AI models. The providers listed above process data on our behalf, under our Data Processing Agreement.
How do I report a vulnerability?
Email security@nexovil.us.ci with what you found, where, and the steps to reproduce it. We read every report and reply by email.
See it for yourself.
Start the 14-day trial with full Pro access and no card. Your data can be exported at any time.