We take your code and secrets seriously
Preview environments touch real production code, real seed data, and real secrets. Here is how Nexos is built to keep them safe — and what we're still working on.
Encryption in transit
Every external endpoint is served over TLS 1.2+. The control-plane-to-agent gRPC channel supports mutual TLS so only enrolled nodes can join the fleet.
Encryption at rest
Environment variables and database passwords are encrypted with AES-256-GCM. Each value gets a unique initialisation vector. The master key is stored in the host environment, never in the database.
Isolation between environments
Every preview runs inside its own containerd container with cgroup-enforced vCPU and vRAM limits. Databases are namespaced per environment and network-scoped to their owning container.
Tenant separation
Projects are scoped by user or team. Every API route enforces ownership and team membership before returning data. We use parameterised queries via Drizzle ORM — no raw string SQL from user input.
Auditability
All deployments, billing events, team membership changes, and admin actions are recorded in append-only ledgers with the acting user, timestamp, and related resource IDs.
Operational controls
Production databases are backed up daily with point-in-time recovery. Access to production infrastructure requires hardware-key MFA. The full control plane is deployable from a single repo so we can rebuild from source in minutes.
Where your data lives — shared responsibility
What Nexos processes depends on where your projects run. Enterprise teams that connect private nodes keep their application data at rest entirely on their own hardware; the Nexos control plane handles orchestration, configuration, and routing.
| Data | Shared pool | Your private nodes |
|---|---|---|
| Source checkouts, images, build caches, running containers, application databases | Nexos-operated nodes | Your hardware only |
| Environment variables & secrets, repo access tokens | Nexos control plane — AES-256-GCM encrypted at rest, decrypted transiently at dispatch | |
| Deployment metadata (branches, commits, changed paths) & build logs | Nexos control plane | |
| Preview URL traffic | TLS terminates at the Nexos edge, forwarded to the node over an encrypted tunnel | |
| Database seeds/backups & external TCP endpoints | Optional — touch Nexos infrastructure only if you upload seeds or create endpoints; skip both to keep database contents off Nexos entirely | |
The full split, our processor obligations, and breach-notification commitments are documented in our Data Processing Addendum.
Subprocessors
We keep the list short. We give 30 days' notice before adding or replacing a subprocessor (see the DPA for the objection process).
| Subprocessor | Purpose | Location |
|---|---|---|
| Contabo GmbH | Control-plane, database, and edge hosting | Germany (EU) |
| Zoho Corporation (ZeptoMail) | Transactional email | EU data center |
| GitHub, Inc. | Source hosting, OAuth, webhooks — via your own GitHub connection | United States |
Paddle.com Market Ltd handles payments as merchant of record and independent controller — we never see your card details.
Compliance & vendor reviews
We are a young company and we are honest about where we are. Here is the current state:
- GDPR-ready data handling. All user data is deletable on request; we do not sell personal data, and we share it only with the subprocessors listed above. Our control plane is hosted in the EU.
- Built for your vendor review. We are not SOC 2 or ISO 27001 certified today and we won't pretend otherwise. Instead, we support your compliance program directly: a signable DPA with a 72-hour breach-notification commitment, this page as a living controls document, security-questionnaire responses, and the private-node architecture that keeps your application data on your own hardware. SOC 2 Type 2 teams can use Nexos this way — their auditors assess us through vendor management, not through our certification.
Report a vulnerability
Found a security issue? Please email security@nexos.rs with a description and reproduction steps. We triage within one business day and will keep you updated until the fix ships. Act in good faith and we will treat you in kind — no legal action for responsible disclosure.
Want deeper detail? See our architecture docs or reach out for a security questionnaire.