Security at Nexu HR
How we protect the data your team trusts us with.
Encryption
All traffic between your browser and Nexu HR is encrypted with TLS 1.3. Data at rest in our Postgres database and file storage is encrypted with AES-256 by Supabase. Secrets and OAuth refresh tokens are stored in encrypted columns.
Row-level security
Every table in our multi-tenant database has Postgres Row-Level Security policies enforced at the database engine level. A user can never read or write rows belonging to a different company — the database itself rejects the query, regardless of any application bug.
Access control
Role-based access control with six built-in roles (Super Admin, HR Admin, Recruiter, Hiring Manager, Interviewer, Employee). Confidential vacancies can be restricted to a specific hiring panel so they are invisible to the rest of the company.
Backups
Daily automated backups are taken by Supabase with point-in-time recovery up to the last 24 hours. We test restore procedures quarterly. Customers can export their own data at any time from the export buttons in every table.
Audit logging
Sensitive actions — vacancy publish, candidate phase changes, employee data updates, settings changes — are recorded in an activity log inside each company. Logs are immutable from the application and accessible to admins for compliance reviews.
Vendor security
Every sub-processor we use (Supabase, Vercel, Stripe, Anthropic, Resend, Cloudflare, Google) is bound by a Data Processing Agreement and inherits the same confidentiality and security obligations Nexu HR commits to its customers. The full list lives at /sub-processors.
Compliance roadmap
Nexu HR is built on infrastructure that already inherits SOC 2, ISO 27001 and GDPR compliance from our hosting partners (Supabase, Vercel and Cloudflare). Our own controls roadmap:
- SOC 2 Type II audit kickoff after general availability
- ISO 27001 certification scoping in parallel with SOC 2
- External penetration test before each major release
- Bug bounty program once we cross 100 paying customers
Reporting a vulnerability
If you believe you have found a security vulnerability in Nexu HR, please report it privately to security@nexuhr.com. We acknowledge reports within 1 business day, do not pursue legal action against researchers acting in good faith, and credit reporters in our advisories unless you ask to remain anonymous.