Security

Nexus Sentinel is a security product, so here's plainly what we store and how we protect it.

What we store

• Account information: names, emails, hashed passwords, notification preferences.
• Your client business names, industries, notes, and the vendors and products on their watchlists.
• Alert history and an audit log of security-relevant account actions.

We never connect to your clients' networks. There's no agent, no scanner and no credentials to their systems.

How it's protected

• All traffic is HTTPS with HSTS. Pages send a strict Content-Security-Policy and refuse to be framed.
• Passwords are hashed with bcrypt (cost 12). Email verification, password reset and invite links are single-use, expire, and are stored only as SHA-256 hashes.
• Sign-in, sign-up, password reset and invites are rate-limited per IP address and per email.
• Every request for organization data is scoped to your organization on the server. An automated test suite attempts cross-organization reads and writes against every API route on every build.
• Roles (owner, admin, tech) limit who can change billing, routing and team membership. Owners can view an audit log of sign-ins, invitations, role changes, billing changes and deletions.
• Payments are handled by Stripe; card numbers never touch our servers. Stripe webhooks are signature-verified.
• Secrets live only in our hosting providers' encrypted environment settings, never in source code.

AI summaries

Incident summaries are written by Anthropic's Claude from public reporting only. No customer or client data is sent to the model. Article text is treated as untrusted input, and the model is instructed not to invent CVEs, victims or attributions.

Your controls

• Export your organization's data as JSON, or delete your organization or account, from Settings.
• Remove team members and revoke invites at any time.

Reporting a vulnerability

Email chris.repstein@wavenexusdigitalinvest.com with details. Please give us reasonable time to fix the issue before disclosing it.