- Status:
- Superseded
- Version:
- 2026-09-05
- Last reviewed:
- 5 September 2026
- Effective from:
- 5 September 2026
Security
Security principles
nexroom uses risk-appropriate technical and organisational measures. Security is an ongoing process and no internet-connected service can be guaranteed to be entirely free from incidents. The controls below describe the current implementation at a level that does not disclose secrets or weaken protection.
Technical and organisational controls
The service uses the following safeguards for accounts, customer data and sensitive actions.
- Authentication and session management through Supabase Auth; password credentials are not exposed to nexroom application code.
- Server-side organisation and Room authorisation that denies access where an unambiguous active membership is absent, complemented by database row-level security where defined.
- Short-lived, HttpOnly and SameSite-protected contexts for recovery, step-up and sensitive account actions, and same-origin validation for mutations.
- Bounded request sizes, validated payloads, rate limiting and separated hash values to mitigate abuse in public forms.
- Owner-bound data exports with private, no-store responses, checksums and short lifetimes, and multiple safe-off gates before irreversible account deletion.
- Need-to-know access, version-controlled changes, separate production flags and auditable operating instructions.
Report a security issue
Report suspected vulnerabilities or security incidents to the contact form at nexroom.app/kontakta-oss. Describe the affected feature, time and how the issue can be reproduced. Do not send passwords, tokens, national identity numbers, exploit code that causes harm or sensitive customer data in ordinary email.
nexroom acknowledges receipt as soon as reasonably possible, prioritises the report by risk and keeps the reporter informed to the extent security and confidentiality permit. Do not access other customers' data, alter or delete data, disrupt the service or continue testing after a vulnerability has been confirmed.
Certifications and assurance evidence
nexroom currently makes no claim that the business or service is certified under ISO 27001, SOC 2 or an equivalent standard. A provider's certification does not automatically cover nexroom. Any future claim must state the exact scope, issuer, validity and verifiable reference.