Security & trust
Cybersecurity built for SMBs that can't afford a dedicated security team.
Every layer of NexIT Hub — from how your data is stored to how your team accesses it — is designed so a 30-person company gets the same default protections a 3,000-person company writes up in their SOC 2 report.
What we commit to
Five pillars, no marketing varnish.
Each pillar below describes something we actually ship — not a roadmap slide, not a check-the-box claim. Where we depend on the platform, we say so; where we've built it ourselves, we say that too.
Your workspace runs in a dedicated database tenant inside our managed Postgres tier. Every query, backup, and migration is scoped to your tenant — no row-level bleed, no shared schemas, no cross-customer joins. When you offboard, your tenant is dropped along with the rest of your data.
- Per-tenant Postgres tenant managed by the platform — no shared rows.
- Read-side row scoping on every `/api` handler, enforced server-side.
- Workspace exports are produced from a tenant snapshot, never a live cross-tenant query.
Yes. We use role-based access control with per-request server-side row scoping: requests carry an authenticated session, and every read and write is gated through requireAuth() plus a where: { userId: user.id } clause. Admins get an explicit role and a separate requireAdmin() gate — they can never see what their org cannot see.
- Session-bound identity on every `/api` route (no anonymous reads of user data).
- Per-request server-side row scoping — the request handler is the only path that reads.
- Admin role explicitly gated via `requireAdmin()`; IT managers never inherit customer PII.
Application and admin actions are logged — waitlist signups, ticket transitions, admin moderation, and per-user mutations emit structured log records with actor, action, target, and timestamp. The log is tenant-isolated so an auditor can replay exactly what happened in your workspace without seeing anyone else’s data.
- Structured log line per admin action — actor + target + timestamp.
- Application events (signups, ticket transitions, role changes) covered.
- Logs retained per-workspace and exportable on request during incident review.
Yes. Encryption at rest is provided by our managed Postgres tier, which encrypts every disk volume at the storage layer using provider-managed keys. Backups inherit the same encryption posture. We deliberately do not invent an in-app KMS or key-rotation cadence beyond what the platform guarantees — what we say here is exactly what the storage tier delivers.
- Encryption at rest is provided by our managed Postgres tier.
- Backups inherit the storage-tier encryption posture.
- Transport uses TLS everywhere — no plaintext fallbacks in our middleware.
You have a direct security contact at nexit-hub@polsia.app. We acknowledge within one business day, post a written timeline within five business days, and disclose the scope, the data classes affected, and the mitigations we applied. We do not run a full CERT — what we promise is a tight response loop and full transparency with the customers actually affected.
- Direct security contact: nexit-hub@polsia.app.
- Written acknowledgment within one business day of a credible report.
- Written timeline (scope + data classes + mitigation) within five business days.
Compliance posture
What we're aligned to.
Our security checklist is mapped to the controls a small-business auditor or prospect actually asks about. We use the language “aligned to” deliberately — not “certified to.” Every framework below is in our internal checklist; we can walk you through the controls on a call.
- SOC 2
- Type 2 trust criteria aligned in our checklist. Evidence collection is mapped to the common controls.
- NIST CSF 2.0
- Posture scoring mapped to the NIST baseline functions (identify, protect, detect, respond, recover).
- ISO/IEC 27001:2022
- Annex A controls reviewed annually and reviewed against our internal control set.
Ready to evaluate us?
See the plan that fits your team.
Per-seat pricing across Starter, Pro, and Business — every plan includes the trust center above. If a security review is on your buying checklist, our team will walk through controls on a call.