SSH hardened, no port forwarding
SOC 2 CC6.1Remote administrative access is hardened: key-based only, with forwarding features disabled.
Checking system status
NexoRush Trust Center
Security you can verify
See how NexoRush protects accounts, payments and marketplace data, and review the controls independently assessed against SOC 2 Trust Services Criteria.
SOC 2 readiness
Verified controls, explained clearly
These controls were reviewed against the relevant SOC 2 Trust Services Criteria. Readiness is not the same as holding a SOC 2 attestation report.
Security11 controls
Security
Protection of systems and data against unauthorized access.
SSH reachable only over private VPN, firewall default deny
SOC 2 CC6.6Administrative access is not exposed to the internet; the host firewall denies inbound traffic by default.
Database not exposed to the internet
SOC 2 CC6.6The database only accepts connections from private networks.
Source repository private
SOC 2 CC6.6Application source code is kept in private repositories.
Webhooks over HTTPS only
SOC 2 CC6.7Webhooks never send data over plain, unencrypted HTTP.
TLS web server hardened
SOC 2 CC7.1The web server runs a validated configuration with TLS encryption.
Brute-force protection active
SOC 2 CC7.1, CC7.2Repeated failed sign-in attempts are automatically blocked.
Authentication logging monitored
SOC 2 CC7.2Successful and failed sign-in activity on servers is logged and reviewed.
Operating system fully patched
SOC 2 CC6.8, CC7.1All available operating system security updates are installed.
Backend dependencies: no known vulnerabilities
SOC 2 CC6.8, CC7.1Production backend packages were checked against public vulnerability databases with no known issues found.
Frontend dependencies: no known vulnerabilities
SOC 2 CC6.8Production frontend packages were checked against public vulnerability databases with no known issues found.
Security
Protection of systems and data against unauthorized access.
SSH hardened, no port forwarding
SOC 2 CC6.1Remote administrative access is hardened: key-based only, with forwarding features disabled.
SSH reachable only over private VPN, firewall default deny
SOC 2 CC6.6Administrative access is not exposed to the internet; the host firewall denies inbound traffic by default.
Database not exposed to the internet
SOC 2 CC6.6The database only accepts connections from private networks.
Source repository private
SOC 2 CC6.6Application source code is kept in private repositories.
Webhooks over HTTPS only
SOC 2 CC6.7Webhooks never send data over plain, unencrypted HTTP.
TLS web server hardened
SOC 2 CC7.1The web server runs a validated configuration with TLS encryption.
Brute-force protection active
SOC 2 CC7.1, CC7.2Repeated failed sign-in attempts are automatically blocked.
Authentication logging monitored
SOC 2 CC7.2Successful and failed sign-in activity on servers is logged and reviewed.
Operating system fully patched
SOC 2 CC6.8, CC7.1All available operating system security updates are installed.
Backend dependencies: no known vulnerabilities
SOC 2 CC6.8, CC7.1Production backend packages were checked against public vulnerability databases with no known issues found.
Frontend dependencies: no known vulnerabilities
SOC 2 CC6.8Production frontend packages were checked against public vulnerability databases with no known issues found.
Availability1 controls
Availability
Systems are available for operation and use as committed.
Backups configured
SOC 2 A1.2Automated database and file backups are configured and completing successfully.
Availability
Systems are available for operation and use as committed.
Backups configured
SOC 2 A1.2Automated database and file backups are configured and completing successfully.
How NexoRush protects the platform
Security practices5
Infrastructure on Cloudflare
Traffic is served through Cloudflare's global edge network with DDoS protection and a web application firewall.
HTTPS everywhere (HSTS)
All connections use TLS. HTTP Strict Transport Security instructs browsers to always connect securely.
Content Security Policy
A Content Security Policy restricts which sources may load scripts and content in the browser.
Secure authentication
Sign in with Google or with email and password, protected against automated abuse.
Payments via Stripe
Card payments are handled by Stripe Checkout. Card details never touch NexoRush servers.
Infrastructure on Cloudflare
Traffic is served through Cloudflare's global edge network with DDoS protection and a web application firewall.
HTTPS everywhere (HSTS)
All connections use TLS. HTTP Strict Transport Security instructs browsers to always connect securely.
Content Security Policy
A Content Security Policy restricts which sources may load scripts and content in the browser.
Secure authentication
Sign in with Google or with email and password, protected against automated abuse.
Payments via Stripe
Card payments are handled by Stripe Checkout. Card details never touch NexoRush servers.
Subprocessors
Service providers that help us operate NexoRush and process data on our behalf.
View subprocessors3
Trust documents
Request security documentation when your review requires it.
View trust documents3
SOC 2 Readiness Summary
Summary of the SOC 2 readiness assessment.
View verified summarySecurity Policy Overview
High-level overview of security policies.
Request accessSubprocessor List
Current list of subprocessors.
Ask for the documentSOC 2 Readiness Summary
Summary of the SOC 2 readiness assessment.
View verified summarySecurity Policy Overview
High-level overview of security policies.
Request accessSubprocessor List
Current list of subprocessors.
Ask for the documentSecurity question or vulnerability?
Contact the NexoRush security team directly.
Control status last reviewed 4 November 2026