- Status:
- Published
- Version:
- 2026-09-10
- Last reviewed:
- 10 September 2026
- Effective from:
- 10 September 2026
Security
Security principles
nexroom uses risk-appropriate technical and organisational measures. Security is an ongoing process and no internet-connected service can be guaranteed to be entirely free from incidents. Here we describe how we protect accounts and information in the service.
Technical and organisational controls
The service uses the following safeguards for accounts, customer data and sensitive actions.
- Supabase Auth manages sign-in and signed-in sessions.
- Access to organisations and rooms is checked on the server. Access is denied if an unambiguous active membership is missing. Database access rules provide additional checks where defined.
- Recovery and sensitive account actions use temporary security checks. We also check that requests to make changes come from the correct website.
- Information submitted through forms is checked, and the number of requests is limited to prevent misuse. We also limit how much information can be submitted at once.
- Exported information is available only to the authorised person and for a limited time. Downloads instruct the browser not to keep a cached copy, and a checksum allows the integrity of the file to be checked. Several security checks must pass before an account can be permanently deleted.
- Internal access is limited according to work responsibilities. Changes to the service are recorded, features can be enabled separately and operations follow documented instructions.
Report a security issue
Report suspected vulnerabilities or security incidents to the contact form at nexroom.app/kontakta-oss. Describe the affected feature, time and how the issue can be reproduced. Do not send passwords, tokens, national identity numbers, exploit code that causes harm or sensitive customer data in ordinary email.
nexroom acknowledges receipt as soon as reasonably possible, prioritises the report by risk and keeps the reporter informed to the extent security and confidentiality permit. Do not access other customers' data, alter or delete data, disrupt the service or continue testing after a vulnerability has been confirmed.
Certifications and assurance evidence
nexroom currently makes no claim that the business or service is certified under ISO 27001, SOC 2 or an equivalent standard. A provider's certification does not automatically cover nexroom.