Security

Encryption

All data at rest is encrypted using AES-256. All data in transit is protected with TLS 1.2 or higher. Encryption keys are managed through Azure Key Vault with automated rotation.

Authentication

Passwords are hashed using bcrypt with a minimum cost factor of 12. We support multi-factor authentication (MFA) via TOTP apps such as Google Authenticator and Authy. Session tokens are short-lived and rotated on privilege escalation.

Access Control

Access to files and folders is governed by a role-based permission system. Workspace owners can define granular roles — viewer, editor, and admin — and restrict access to individual documents or entire directory trees. All access events are logged to an immutable audit trail.

Infrastructure

Nexaro Workspace runs on Microsoft Azure with resources deployed across redundant availability zones. Our infrastructure is managed as code (IaC) and undergoes regular patching cycles. Network access is restricted through virtual networks and private endpoints.

Application Security

Our development process includes:

• Mandatory code review before any change is merged to production
• Static analysis and dependency vulnerability scanning in CI/CD
• Protection against OWASP Top 10 vulnerabilities (SQL injection, XSS, CSRF, etc.)
• Rate limiting and brute-force protection on all authentication endpoints

Audit Logs

Every file access, permission change, login attempt, and admin action is recorded with a timestamp and user identity. Audit logs are immutable, retained for 12 months on paid plans, and exportable in CSV or JSON format.

Backups

Your data is backed up daily to geographically separate Azure regions. Backups are retained for 30 days. Point-in-time recovery is available on Business plans.

Vulnerability Disclosure

We welcome responsible disclosure of security vulnerabilities. If you discover a potential issue, please contact us at security@nexaro.io. We commit to acknowledging your report within 48 hours and providing a resolution timeline within 7 days.

We ask that you do not publicly disclose the issue until we have had a reasonable opportunity to investigate and remediate it.