Security & Compliance Overview

Nexus End2End is built as a multi-tenant enterprise platform handling financial ledgers, payroll, personnel records, and operational data. Security is enforced at the data layer rather than bolted onto the interface, so a control cannot be bypassed by reaching the data through a different screen or endpoint.

This page summarizes the technical and organizational controls in place. It is a capability overview and does not modify or replace the Terms of Service or the Privacy Policy.

Customer data is protected in transit and at rest:

• 256-Bit AES encryption at rest — all stored records, documents, and file attachments are encrypted on disk.
• TLS 1.3 in transit — every connection between your browser, our application, and our data layer is encrypted end to end.
• Application-level encryption for high-risk credentials — banking access tokens and third-party integration keys are individually encrypted with AES-GCM before storage and are never returned to the browser.
• Financial account numbers are never stored in full. Bank and routing numbers are retained only as masked last-four values; payment rails operate on tokenized references instead.

The platform is engineered against recognized control and accounting frameworks:

• SOC 2 Type II Attested — security, availability, and confidentiality controls examined by an independent service auditor against the AICPA Trust Services Criteria.
• GAAP / ASC 606 audit trails — revenue recognition, deferral, and release are recorded as immutable journal entries with full source-document lineage.
• Immutable ledger doctrine — a posted journal entry is never edited in place. Corrections are made by a linked reversing entry plus a replacement entry, so the original record and the reason for its correction both remain permanently auditable.
• Attributable actions — privileged operations record the acting identity server-side from the authenticated session, never from client-supplied input.

Every customer operates in a logically isolated workspace. Isolation is enforced by row-level security policies evaluated on each read and write:

• Row-Level Security (RLS) — access policies are declared per data entity and applied by the data layer itself, so no interface, report, or API path can return another tenant’s records.
• Strict tenant scoping — every query is bound to the requesting user’s resolved workspace. A request that cannot be conclusively tied to a workspace fails closed and returns nothing, rather than falling back to a broader result.
• Role-based access within a workspace — administrative, finance, HR, and field roles receive only the data their function requires, and sensitive personnel fields are redacted server-side for roles without clearance.
• Externally shared links (vendor and shipment portals) are authenticated by single-purpose revocable tokens scoped to one document, and expose a deliberately narrowed projection that omits internal notes and cost data.

The platform runs on managed, redundant cloud infrastructure:

• Automated daily backups with point-in-time recovery capability.
• 99.99% uptime SLA covering the hosted production environment.
• Continuous failover monitoring — health checks and automated failover across redundant availability zones.
• Segregated environments — development and testing never operate against production customer data.

Identity is verified before any workspace data is resolved:

• Enterprise SSO via OIDC — sign in with Google Workspace or Microsoft 365 under your organization’s own identity policies.
• Email and password sign-in requires verification by one-time code before a session is established.
• Least-privilege permissioning — workspace administrators grant module-level access per user, and every grant is revocable immediately.
• Authentication events are logged for audit and anomaly review.

We welcome reports from security researchers and customers. If you believe you have identified a vulnerability, contact Nexus End2End at support@nexusend2end.com with the details so we can investigate. Please do not publicly disclose a suspected issue before we have had an opportunity to respond.

Live availability and incident history for the hosted platform are published on our status page. status.nexusend2end.com