01Infrastructure
Nuvnext does not run its own servers or data centers. The application and the database run on cloud providers with SOC 2 Type II certification, responsible for physical security, network and hardware.
Every client with its own platform has a separate database, in its own project.
02Encryption
| Scope | Measure |
|---|---|
| In transit | TLS 1.2 or higher on every connection. HTTP Strict Transport Security with includeSubDomains and preload: the browser never attempts an unencrypted connection. |
| At rest | AES-256 for the database, backups and file storage, managed by the cloud provider. |
| Credentials | Keys and secrets live in the provider's environment manager, never in the code. |
03Data isolation
Isolation between clients lives in the database, not in the screen. Even if a query arrives without going through the application, the database only returns the rows that belong to whoever is asking.
- Row Level Security enabled on every table.
- Every view enforces the permissions of its source tables.
- Users and visitors have no permission to empty an entire table.
All three are verified by an automated sweep that runs on every code change.
04Application security
| Control | What it prevents |
|---|---|
| Content Security Policy | The site running code or loading resources from unauthorized origins. |
| Clickjacking protection | Another page loading ours inside its own to trick the user. |
| Validated redirects | A tampered link sending the user to a fake site after signing in. |
| Isolation headers | The browser misreading file types or sharing context with other sites. |
05Secure development
- Every code change goes through an automated security review. A change that makes a control worse is flagged right away.
- Secret scanning on every change, so no key reaches the repository.
- Automatic alerts when a dependency publishes a vulnerability.
- The database schema is versioned in the repository. What is in the code is what runs in production.
- Confidential client and financial information cannot enter the code history.
06AI agents
Agents follow the same principle as people: least privilege, and approval for anything that goes out.
- Every agent has its own permission key, separate from people's, and reads only the modules of its job.
- The language model receives the text the task needs, not access to the database.
- A quote, a message to a client or a money movement waits for a person's approval.
07Continuity
- Automatic database backups. Their existence is verified on the first day of every month.
- Real-time error monitoring in the browser, the server and the edge.
08Privacy
We process personal data under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties. Purposes, transfers and how to exercise data subject rights are in our privacy notice.
We do not sell or trade personal data.
09Framework and documentation
Our internal security framework has 50 controls, each mapped to the standards procurement and audit teams use:
| Document | Availability |
|---|---|
| Security questionnaire | SIG Lite, CAIQ or your company's format. On request. |
| Control mapping | Control by control, against your auditor's standard. On request. |
| Data processing agreement | With the contract. |
| Subprocessor list | Under a confidentiality agreement. |
10Vulnerability reporting
If you find a vulnerability, write to seguridad@nuvnext.com before making it public.
- We reply within two business days and let you know when it is fixed.
- We take no legal action against anyone who reports in good faith.
- We ask you not to access, modify or delete third-party data, not to degrade the service, and to give us reasonable time to fix it before disclosure.