Security at NexqData
Built to keep your collection infrastructure, credentials, and data protected.
This page describes what’s in place today, as it’s built. It makes no certification claims. If your review needs more than this, send us your questionnaire and we’ll answer it directly.
Data protection
How your data moves, and who can see it.
- Encryption in transit
- Traffic between your browser or systems and NexqData runs over HTTPS. The platform redirects plain HTTP and sends HSTS, so browsers won't fall back to an unencrypted connection.
- Data isolation
- Datasets are private to the user who collected them by default, and are shared with the rest of your company only when someone chooses to. Asking for data you can't access returns “not found” — not a hint that it exists.
Access
Who can sign in, and what they can do once they have.
- Authentication
- Passwords of at least 12 characters with mixed character types, email confirmation before first sign-in, lockout after five failed attempts, and Google sign-in. Sign-in endpoints are rate-limited.
- Sessions
- Short-lived access tokens held in HttpOnly, Secure, SameSite cookies, with CSRF protection on every change. You can sign out of every device at once.
- Role-based access
- Roles separate NexqData operators from your team, and company administrators from users. Permissions — running agents, managing agents, managing API keys — are checked on every request.
- Workspace isolation
- Each user sees and runs only the agents, groups, and pipelines assigned to them. Nothing is visible by default.
- API key management
- Keys are shown once and stored only as a hash. They can be limited to specific permissions, revoked at any time, and each records when and from where it was last used.
Infrastructure
How we keep the service observable.
- Monitoring
- Health checks confirm the platform and its database are responding. Every run is tracked to completion, and failed or unusually slow and fast runs are flagged as they happen.
- Logging
- Structured logs of every request, plus an audit trail of account events: sign-ups, sign-ins, failed attempts, lockouts, sign-outs, and password resets — each with its time and IP address.
- Rate limiting
- Sign-in attempts and agent runs are rate-limited, so a burst of password guesses or a runaway script can't overwhelm the platform.
Agent security
How agents run, and how the credentials they use are kept.
- Encrypted credentials
- When a source needs a login, its credentials are stored encrypted on the execution engine. They're never kept in the platform database.
- Secrets management
- Platform secrets — token-signing keys and service credentials — are supplied through configuration outside the codebase, never stored in the database.
- Controlled execution
- Agents run on a separate execution engine on a private network. Only the platform can start them, and only for users permitted to run that agent. Agents are built and deployed by our engineers — no customer-supplied code runs.
Data lifecycle
How long data is kept, and how you get it out.
- Retention
- A retention period can be set for your company or for individual users. Archived files older than it are removed automatically, while the record that the run produced data is kept.
- Deletion
- You can delete your own datasets from the data explorer at any time.
- Exports
- Download any run you have access to — through the workspace or the API — in formats including CSV, JSON, and Excel, individually or in bulk.
- Customer ownership
- The data we collect for you is yours. We don't sell it, and we don't share it.
Running a security review?
Send us your questionnaire or your questions. An engineer will answer them plainly — including where something isn’t in place yet.