Your contacts are other people's data. We treat them that way.

Our database and file storage are encrypted at rest by our infrastructure providers. On top of that, we encrypt the most sensitive fields ourselves, in the application, before they reach the database:

• Contact details people share with you (name, email, phone, company, message)
• Lead form submissions
• Card activation codes
• Integration tokens, such as HubSpot connections
• Webhook signing secrets

These fields use AES-256-GCM with keys held outside the database. Keys carry an identifier so we can rotate to a new key without downtime; older records stay readable and are re-encrypted over time.

To look up an encrypted email address without decrypting everything, we store a blind index: a keyed hash that lets us find an exact match but can't be reversed into the address.

• Passwords are hashed with scrypt, a deliberately slow, memory-hard algorithm. We never store or see your password.
• New passwords are checked against known data breaches using a privacy-preserving range query; only a short prefix of a hash ever leaves our servers.
• Optional two-factor authentication with an authenticator app (TOTP), plus single-use backup codes.
• Sessions expire after 14 days, you can see and sign out other sessions, and resetting your password signs out every other session.
• Sign-in, password reset and other sensitive endpoints are rate limited.

• Rate limiting on sign-in, contact exchange, lead forms and sales requests, enforced across every server.
• Bot protection on public forms, using hidden honeypot fields and minimum fill times, without third-party captchas that track visitors.
• Uploads are re-encoded. Every image that appears on a profile is decoded and re-saved by our servers, which strips EXIF metadata, including GPS location, and neutralises malformed files. Print files you send us for your card are checked by content, stored privately and only ever opened by our production team.
• Least privilege. Server code checks ownership on every request; people can only ever reach their own profiles, cards and contacts, or their team's.
• Audit log. Security-relevant actions such as sign-ins, plan changes and administrative changes are written to an audit log.

Profile analytics tell you how many people viewed your profile, saved your contact or opened a link. They're designed so we never need to identify visitors:

• No cookies, local storage or fingerprinting scripts on public profiles.
• To count unique visitors, we combine the request's IP address and browser with a random salt that changes every day, hash the result, and store only a short hash. Salts are deleted after two days, so hashes can't be linked across days or reversed.
• The IP address itself is never stored with analytics. Country and city are looked up in memory at request time and only the result is kept.

Nexus runs on managed infrastructure in our primary data region, European Union. The database, its backups and uploaded files are kept in that region.

Backups are encrypted and retained for a limited period so we can recover from failure. Access to production systems is limited to a small number of named engineers and administrators.

Staff access to customer accounts for support is restricted to administrators and time-limited to 30 minutes per session. Administrative actions are recorded in the audit log.

Who is responsible for what

For your own account (your name, email, profile and billing), Nexus is the controller.

For contacts and leads collected through your profile, you are the controller and Nexus is your processor. We process that data only to provide the service to you, under our data processing agreement.

Lawful basis and consent

When someone shares their details through Exchange or a lead form, they must tick a consent box that names you. We store the time consent was given alongside the submission, so you can show where every contact came from.

Your rights

• Access and portability (Art. 15 and 20): export your profile, contacts and analytics from the dashboard, or ask us for a full copy.
• Erasure (Art. 17): delete individual contacts yourself, or delete your whole account. We also act on requests sent to hello@nexustap.co.
• Rectification (Art. 16): edit your profile and account details at any time.

Business customers can review and accept our data processing agreement, which includes standard contractual clauses where needed.

• Analytics events: about 25 months, then deleted automatically.
• Daily analytics salts: deleted after 2 days.
• Rate-limit records: deleted after 1 day.
• Webhook delivery logs: 30 days.
• Closed sales requests: 2 years.
• Account data, profiles and contacts: kept while your account is active and deleted when you delete your account, apart from what we must keep by law (such as invoices).

We use a small number of carefully chosen providers to run Nexus. Each is bound by a data processing agreement. We'll update this list before adding a new subprocessor that handles personal data.

Found a vulnerability? Please email hello@nexustap.co with the details and steps to reproduce. We'll acknowledge your report, keep you updated and credit you if you'd like.

Please don't access other people's data, run denial-of-service tests or use automated scanners against production. Our security.txt follows RFC 9116.