Security isn’t a tab on our website — it’s a discipline we run continuously. NexaFlow is SOC 2 Type II certified, GDPR-compliant, ISO 27001 in progress, and runs in EU or US data residency. Daniel Okonkwo, our CTO, owns this end-to-end.
Automated detection pages the on-call engineer. Ravi Subramanian owns the rotation and the escalation path.
A public status entry goes up within fifteen minutes of detection, whether or not we understand the cause yet.
Until resolution, an update every thirty minutes, even when the update is that we still do not know.
Published in full inside five working days, including the parts that make us look careless.
Write to [email protected]. We acknowledge inside one working day and aim to triage inside three. We do not run a public bug bounty with a leaderboard, but we do pay for valid findings and we credit researchers who want to be credited.
Please do not test against another customer’s workspace. Sandboxes are free on every plan, including Starter, and give you the full API surface to work against.
DPA, SCCs and the SOC 2 report are available on request.