Security & compliance

Security is a first-class concern at Kononko Technologies, LLC, not an afterthought. Because Nextora unifies your CRM, inbox, automations, and analytics on a single data model, protecting that data is core to everything we build.

We design with defence in depth: data is encrypted, access is least-privilege, infrastructure is monitored continuously, and every paid workspace is isolated on its own server. This page summarises the controls we have in place today and states plainly what is still on the roadmap.

• All traffic to Nextora is encrypted in transit using TLS 1.2 or higher.
• Integration credentials, such as connected mailboxes and API tokens, are stored encrypted with a key unique to each workspace.
• Off-site backups are kept with a separate provider, apart from the server they protect.

Access to production systems and customer data is restricted to authorised personnel on a least-privilege, need-to-know basis, and is reviewed regularly.

• Role-based access control (RBAC) across the platform.
• Single sign-on (SSO/SAML) and SCIM provisioning are on the roadmap for enterprise plans.
• Two-factor authentication for workspace members.
• An audit log that cannot be edited records sign-ins, record changes and permission grants.

Nextora is hosted in the European Union. Every paid workspace runs on its own dedicated server with its own application and database, so one customer's data never shares a database with another's. During the free trial, a workspace runs on shared trial infrastructure.

• Health monitoring and alerting for every workspace server.
• Automated backups, kept for 7, 30 or 90 days depending on the plan.
• Updates released to workspaces in stages rather than all at once.
• Third-party penetration testing is on the roadmap.

Workspace servers and backups are hosted in the European Union. AI features send the content needed for a request to the AI model provider through Nextora's AI gateway. Where data is transferred internationally, we rely on appropriate safeguards such as Standard Contractual Clauses, as described in our Privacy Policy.

Where we stand today:

• GDPR and UK GDPR: aligned by default; a Data Processing Addendum (DPA) is available to customers.
• SOC 2: our controls are designed around the SOC 2 Trust Services Criteria. A formal independent audit is planned; we do not hold a SOC 2 report yet.
• ISO 27001: not certified. We will state it here if and when we are.

A current list of subprocessors and our DPA are available on request.

We welcome reports from security researchers. If you believe you have found a vulnerability, please report it to [email protected] with enough detail to reproduce the issue. We commit to acknowledging your report promptly, investigating in good faith, and keeping you informed.

Please act in good faith: do not access or modify data that is not yours, avoid privacy violations and service disruption, and give us reasonable time to remediate before any public disclosure.

For security questions, audit reports, or to report a vulnerability, contact our security team at [email protected].