Security Policy
Last updated: May 23, 2026
Marcoby takes security seriously. This policy outlines our security practices and how to responsibly report security vulnerabilities in Nexus.
Security Practices
Tenant Architecture & Isolation
- Shared Cloud (Personal/Team): Data is logically isolated. All queries are strictly scoped at the application layer using identity claims (Authentik JWT) to ensure users can only access their organization's data.
- Private Cloud / Self-Hosted: Data is physically isolated. Customers receive dedicated infrastructure and a dedicated PostgreSQL database, eliminating any risk of cross-tenant data bleed.
Data Protection
- Encryption at rest (AES-256) for all data
- Encryption in transit (TLS 1.2+)
- Encrypted backups in geographically distributed locations
- Industry-standard key rotation and access controls
Access Controls
- Multi-factor authentication (MFA) support
- Role-based access control (RBAC)
- Automatic timeout for inactive sessions
- Comprehensive audit logging (90-day retention)
Infrastructure
- Network segmentation with strict firewall rules
- DDoS protection via Cloudflare
- Intrusion detection monitoring
- Regular vulnerability scanning and testing
Development
- Code review before all deployments
- Static and dynamic security testing in CI/CD
- Secure secrets management (no hardcoded credentials)
- Regular dependency scanning and updates
Incident Response
- 24/7 automated monitoring and alerting
- Critical incidents triaged during business hours
- Affected customers notified within 72 hours of confirmed breach
- Root cause analysis published within 14 days
Responsible Vulnerability Disclosure
We welcome security researchers and ethical hackers to help find and fix vulnerabilities responsibly.
What We Encourage
- SQL Injection, XSS, CSRF, or other web application vulnerabilities
- Authentication/authorization flaws
- API security issues
- Insecure data storage or transmission
- Business logic flaws with security impact
What We Don't Care About
- Vulnerabilities in LinkedIn, X, Microsoft, HubSpot, or Ghost (report to them directly)
- Low-impact issues: missing headers, outdated libraries with no impact
- Denial-of-service attacks or brute-force testing
- Social engineering or phishing
How to Report
Email [email protected] with:
- Clear description of the vulnerability
- Steps to reproduce (with proof of concept if possible)
- Affected components and versions
- Potential impact assessment
- Your contact information
Do not: Test on production systems, modify or delete data, share details publicly before we fix it, or perform DoS testing without authorization.
Disclosure Timeline
- Initial Response: Within 5 business days
- Vulnerability Confirmed: Within 10 business days
- Public Disclosure: After fix is deployed and customers are notified
Safe Harbor
If you report a vulnerability responsibly according to this policy, we will not pursue legal action against you. Your testing activities are authorized, and we will work with you in good faith. Your identity will be kept confidential unless you request public credit.
Beta Note
Nexus is currently in beta. We do not currently operate a formal bug bounty program, but we recognize and appreciate security researchers who report vulnerabilities responsibly. Upon production release, we plan to offer bounties for critical and high-severity vulnerabilities.