How we protect your apps, in plain words
Before you trust a platform with your code and your customers' data, you should be able to read exactly how it is built and run. This page says what is in place today, what is planned, and how to reach us when something looks wrong.
The short version
Data in India
Your apps, databases, files and backups are stored and run in data centres in India.
Nothing shared
Each customer has its own sign-in space, code, secrets, database, cache, files and sandboxed runtime.
Restore-tested backups
Encrypted nightly backups copied off-site, with automatic restore tests every week.
Checked releases
Every release is scanned for leaked keys, risky code and vulnerable packages before it goes live.
Five checkpoints on every request
The platform is designed for zero trust: nothing is trusted because of where it sits. Every person, app and server proves who it is, every time.
| Checkpoint | What it does | State |
|---|---|---|
| 1 · Shield | One public entrance with TLS on every connection, attack filtering and security headers. Admin consoles of the identity service are not reachable from the internet. | Live |
| 2 · Isolate | All servers sit on a private network with no public addresses. Customer apps are fenced off the internal network: they reach their own database, cache and vault, and the internet, nothing else. | Live |
| 3 · Verify | Nexovia ID gives people single sign-on with two-step verification and account lockout after repeated failures. Each app has one identity bound to its own server. | Live |
| 4 · Contain | Customer apps run inside Nexovia Sandbox with CPU, memory and process limits, in hardened containers with no extra privileges. Builds run on a separate, fenced build service. | Live |
| 5 · Protect | Secrets live in Nexovia Vault, never in code. Each app has its own database user and file area. Backups are encrypted before they leave the server. | Live |
Operations you can check
Backups and recovery
Databases are dumped every night and copied, encrypted, to separate storage in India. Point-in-time recovery for the database cluster is switched on. A restore is tested automatically every week and compared table by table. Recovery keys are split between two named directors of the company.
Release gates
Every release is built from a clean checkout, scanned by Zecurix Guard for secrets and risky code, and checked for vulnerable packages. A critical problem with a known fix stops the release while the live version keeps serving. A new version must pass its health check before traffic moves to it.
Monitoring and alerts
Every server, database and public address is monitored around the clock. Alerts reach the on-call engineer within a minute, and a daily report covers servers, backups, releases and capacity. Logs are kept in India.
Access by our own team
Operators sign in with a second factor and use audited, scripted procedures instead of ad-hoc server changes. Dangerous operations need an extra break-glass confirmation. Every action is written to an audit trail.
Incidents
We investigate every alert, fix the cause rather than the symptom, and write it down. Customers affected by an incident hear from us directly. Reportable cyber incidents are reported to CERT-In within six hours, as Indian law requires.
Change control
Before any change to core systems, every backup is run and the off-site copy is verified. Changes happen in planned windows, one server at a time, so the platform stays up while it is updated.
Your data, your rules
Data residency
Your apps, databases, files and backups are stored and run in India. Public traffic is encrypted and filtered by our network protection before it reaches India-based servers, which means some traffic can pass through other countries in transit, encrypted.
DPDP Act, 2023
For personal data inside your apps you are the data fiduciary and we process it on your instructions. We keep each customer's data separate, delete it on request at the end of the contract, and never use it for advertising or to train AI models.
Shared responsibility
We secure the platform: servers, network, sandbox, vault, backups and the release checks. You secure what you build: your code's logic, your users' accounts and roles, and the data you choose to collect. The release checks help you, but they do not replace your own review.
Service providers
We use a small number of carefully chosen providers: an Indian cloud infrastructure company for servers and storage, a network protection service for public traffic, and an e-mail delivery service for platform e-mail. The current list, with what each one processes, is available to customers on request.
Honest about where we are
We would rather show you a dated plan than a badge we have not earned. Nexovia is not certified today. This is the plan.
| Step | What it means for you | When |
|---|---|---|
| Trust Centre, disclosure policy and security.txt | You can read how we work and report a problem safely | Live now |
| Pre-answered security questionnaire | Answers to standard cloud security questions within a day | November 2026, on request |
| Security review of our own platform by Zecurix | A dated summary of what was tested and fixed, published here | Winter 2026 |
| ISO/IEC 27001 information security and ISO 9001 quality management | Independent certification of how we manage security and quality | Planned for 2027 |
| Independent penetration test by an empanelled auditor | An outside team attacks the platform and we fix what they find | Planned for 2027 |
We will update this table as each step completes, with dates.
A registered Indian company
Company facts
Nexovia Technologies Private Limited, incorporated on 26 December 2025 under the Companies Act, 2013. CIN U62020MH2025PTC464221, registered with the Registrar of Companies, Maharashtra. Registered office in Vasai East, Maharashtra 401208.
Talk to us
Sales and general questions: hello@nexovia.co.in. Security reports: security@nexovia.co.in (see the disclosure policy). Or leave your number with Quick Connect and we call you back.
Security and trust questions
Is Nexovia ISO 27001 certified?
Not yet. ISO/IEC 27001 and ISO 9001 certification are planned for 2027, and we publish the dated plan on this page. Until then we show you the controls themselves and answer security questionnaires on request.
Where exactly is my data stored?
Your apps, databases, files and backups are stored and run in data centres in India. Off-site backup copies are also kept in India.
Can other customers see my data?
No. Each customer has its own database user, file area, secrets, sign-in space and sandboxed runtime. Apps are fenced off from each other and from the internal network.
How often is my data backed up, and is the backup tested?
Every night, encrypted and copied off-site in India. A full restore is tested automatically every week and compared table by table with the live data.
Do you use my data to train AI models?
No. Your code and data are used only to run your apps.
How do I report a vulnerability?
Write to security@nexovia.co.in with the details. Our disclosure policy explains what to include, what is in scope and how we respond; we acknowledge reports within three working days.
Can you fill in our vendor security questionnaire?
Yes. Send it through Quick Connect or by e-mail. We keep a pre-answered set for standard cloud security questions and return most questionnaires within a few working days.