How we protect what you give us
Two of our divisions handle health data and one moves money. That sets the security floor for the entire group — not a separate "enterprise tier".
Mapped to recognised standards
Our internal control set is mapped to ISO/IEC 27001 Annex A, with additional controls drawn from ISO/IEC 42001 for AI management, UK and EU GDPR, and HIPAA safeguards where health data is in scope.
On certification status. We describe our controls as aligned to these standards. Where a formal certification or attestation has been completed for a specific service, the certificate and its scope are provided under NDA on request — we do not imply certification we do not hold.
What is actually implemented
Encryption
TLS 1.3 in transit with HSTS preload. AES-256 at rest with envelope encryption and per-tenant keys held in a managed KMS. Keys rotate on a 90-day schedule; media in consultations additionally uses per-session keys.
Access management
SSO with enforced MFA, role- and attribute-based authorisation decided centrally, and no standing production access. Elevation is just-in-time against a named ticket, approved by a second person and expires automatically.
Audit & monitoring
Append-only access logs on every record read, write and export, retained and queryable per tenant. Security events stream to a central pipeline with alerting on anomalous access patterns and privilege changes.
Network & workload
Default-deny network policy between services, mutual TLS for internal traffic, workload identity instead of long-lived credentials, and admission control that refuses unsigned images or undeclared data classes.
Supply chain
SBOM generated for every build, dependency and container scanning with a hard gate on high-severity findings, artefact signing verified at deploy, and pinned base images rebuilt on a schedule.
Resilience
Multi-region active-active deployment, point-in-time recovery within five minutes, and disaster recovery exercised quarterly against a stated RTO of 60 minutes — including the failures we find.
Classification, residency and retention
Every dataset carries a class. The class determines where it may live, who may read it, how long it is kept and what happens when it expires.
| Class | Examples | Residency | Access | Default retention |
|---|---|---|---|---|
| Clinical | Consultation records, prescriptions, monitoring data | Region-pinned, no cross-region replication | Named clinical roles; every read logged | Set by the operating organisation |
| Identity | Account details, verification documents | Region-pinned | Verification team, break-glass alerted | Account life + statutory period |
| Financial | Orders, invoices, payout records | Region-pinned; card data never touches our servers | Finance roles only | 6 years (tax/accounting) |
| Operational | Logs, traces, metrics | Region-pinned; PII scrubbed at ingestion | Engineering, no clinical content | 30–90 days |
| Public | Marketing site, documentation, listings | Global CDN | Open | Indefinite |
Residency is enforced, not promised
Region pinning is applied by admission policy: a workload that would breach it is refused by the cluster.
Card data stays out of scope
Payment details are captured by our PCI-compliant payment providers directly. We store tokens, never card numbers.
Nothing personal goes on-chain
Where Nexiv Chain anchors a record, only a salted commitment is written — so erasure rights remain intact.
Who else touches the data
We use third parties for infrastructure, payments and communications. Each is assessed before onboarding, bound by a data processing agreement, and reviewed annually. Customers on a DPA receive 30 days' notice before a new sub-processor is added.
| Category | Purpose | Data touched | Region control |
|---|---|---|---|
| Cloud infrastructure | Compute, storage, managed databases | All classes, encrypted | Tenant-pinned region |
| Edge & CDN | TLS termination, WAF, static delivery | Request metadata only | Global edge, no origin data at rest |
| Payment processing | Card capture, settlement, payouts | Payment data, direct to processor | Processor's own compliance scope |
| Communications | Transactional email, SMS, push | Contact details, message content | Regional sending endpoints |
| Real-time media | WebRTC signalling and TURN relay | Encrypted media streams in transit | Regional media servers |
| Identity verification | KYC and licence checks for sellers/clinicians | Verification documents | Region-appropriate provider |
| Observability | Logs, traces, metrics, alerting | Operational data, PII scrubbed | Region-pinned collection |
The current named sub-processor list, with entity names and locations, is provided as part of our data processing agreement. Request it at support@nexivlabs.com.
Found something? Tell us before you tell anyone else
We welcome reports from security researchers and will not pursue legal action against anyone acting in good faith under this policy.
- Email support@nexivlabs.com with "SECURITY" in the subject line
- Include reproduction steps, affected endpoints and impact assessment
- We acknowledge within 2 business days and give a remediation timeline within 10
- Please allow 90 days before public disclosure, or sooner by agreement
Out of scope: denial-of-service testing, social engineering of staff or customers, physical attacks, spam or automated scanning that degrades service. Do not access, modify or exfiltrate data belonging to anyone other than a test account you control.
- Sev 1 — CriticalConfirmed data exposure or total service loss. Response begins immediately; affected customers notified without undue delay.
- Sev 2 — HighMajor functional impairment or a credible exploit path. Response within 1 hour, 24/7.
- Sev 3 — MediumDegraded performance or a contained issue with a workaround. Response within 4 business hours.
- Sev 4 — LowMinor defect, no material impact. Scheduled into the normal backlog.
- AssessmentRisk to individuals assessed immediately on confirmation.
- RegulatorNotified within 72 hours where the threshold is met.
- ControllersNotified without undue delay where we act as processor.
- IndividualsNotified where there is a high risk to their rights and freedoms.
Questions buyers always ask
Need the full evidence pack?
Architecture diagrams, sub-processor list, test summaries and DPA templates are available under NDA.