Security

How we protect our clients

In short:

• Everything is served over HTTPS, with strict browser security settings on every page.
• Client passwords are stored scrambled with a slow, salted method and checked against known data breaches. Two-step sign-in with an authenticator app is available to every client.
• Sign-in attempts are limited, and a client is emailed when a new device signs in.
• Our back office sits behind Cloudflare sign-in, open only to the owners of NXG Technologies.
• Card payments go through Stripe. We never see or store card numbers.
• Automated tests check, among other things, that no client can see another client’s data.

Reporting a security problem

If you think you’ve found a security problem on nxgtech.dev or a site we run, email info@nxgtech.dev with “Security report” in the subject. Tell us what you found, where, and how to see it. We’ll confirm we got it within 3 business days and keep you posted while we fix it.

Testing rules

We won’t pursue legal action against good-faith research that follows these rules:

• Use only your own test account, or ask us for one. Don’t open, change or keep other people’s data; if you reach some by accident, stop and tell us.
• No attacks that slow down or break our sites (denial of service), no spam, and no social engineering of our staff or clients.
• No physical attacks, and no testing of Cloudflare, Stripe or Google themselves; report those to them.
• Give us a reasonable time to fix a problem before telling anyone else.

What we can’t offer

We’re a small business and don’t run a paid bug bounty. We’ll gladly thank you by name on this page if you’d like.