Security

Security is core to everything we do. This page summarizes the controls we operate for our own systems and bring to client engagements.

Platform controls

The Nubevo portal is built to the control objectives a SOC 2 audit examines:

• Access control (CC6). Role-based access (staff vs. client), per-tenant data isolation, and single sign-on via Google and Microsoft. Two-factor authentication is enforced on every sign-in with one-time codes that are stored server-side, hashed, and rate-limited.
• Encryption. TLS 1.2+ in transit with HSTS; passwords and one-time codes are salted and hashed (scrypt). Data at rest is encrypted by our managed database provider.
• Monitoring & audit logging (CC7). A built-in SIEM records every sign-in, API call, third-party integration touch and administrative action to a searchable, retained audit trail.
• Incident response. Built-in incident management with severities, acknowledgement, escalation and on-call — incidents raised from SLA breaches and monitored to resolution.
• Application hardening. Strict Content-Security-Policy, anti-CSRF same-origin checks, rate limiting, signed-and-verified webhooks, and secrets that fail closed when unset in production.
• Backups. Automated, encrypted database backups with point-in-time recovery via our managed provider.

Compliance

Our platform is designed against the SOC 2 Trust Services Criteria and we are pursuing formal attestation. We also help clients reach and maintain SOC 2, ISO 27001 and HIPAA readiness, and can participate directly in their audits. A current controls summary and our subprocessor list are available at /subprocessors.

Responsible disclosure

Found a vulnerability? We appreciate your help. Please email support@nubevo.com with details and give us a reasonable window to remediate before public disclosure. We do not pursue legal action against good-faith researchers.

Contact

Security questions or documentation requests? Email support@nubevo.com.