NexusIQ Security Posture — Tinhvan Japan Co., Ltd. — Last reviewed: 15 September 2026
NexusIQ exists to hold an organization's internal documents, so this page separates three things that are easy to blur: what the product enforces, what your own deployment is responsible for, and what is planned but not yet built. Every control below appears in exactly one of those categories.
Encryption
Stored third-party credentials — connector OAuth tokens and per-workspace model API keys — are encrypted field by field with AES-256-GCM before they reach the database. Document content is not encrypted at the column level, because retrieval has to read it. Encryption at rest for the database, object store and backups is your deployment's responsibility: NexusIQ requires encrypted storage and documents that requirement, rather than providing it.
Authentication
Access tokens are signed with RS256 and expire after 15 minutes. The session itself is carried by a separate refresh token, stored only as a hash, rotated on every use, and revoked across its whole token family if a spent token is ever replayed. Passwords are hashed with bcrypt, and five consecutive failures lock an account for 15 minutes. Multi-factor authentication and single sign-on (SAML, OIDC, LDAP) are planned and are not available today.
Infrastructure
Tenant isolation is enforced twice: once in the application, and again by PostgreSQL row-level security policies on organization-scoped tables, under a database role that holds no bypass privilege. A query that omits its organization filter returns nothing rather than another tenant's rows. TLS is terminated by your own reverse proxy or ingress — NexusIQ requires TLS 1.3, or 1.2 with forward-secret ciphers, in front of it, and does not claim a cipher suite it does not choose.
Vulnerability Management
Every change runs dependency scanning against the Python advisory database and static analysis over the source, and neither can be waved through: a change that introduces a newly vulnerable dependency fails the pipeline. Advisories already present in existing dependencies are tracked against a recorded baseline that is only allowed to shrink. We publish no patch deadline, because committing to one needs an on-call rota we have not yet established.
Access Control
Authorization is decided at four levels — platform, organization, workspace and notebook — each with its own roles. The platform level has five: Super Admin, Organization Director, Organization Admin, Member and Service Account. Security-sensitive events, including every sign-in, failed sign-in, account lockout and session revocation, are written to an append-only audit log that is hash-chained inside the database: each entry commits to the one before it, updates and deletes are refused by the database itself, and an administrator can recompute the chain at any time to confirm that nothing has been altered. In On-Premise and Private Cloud deployments, Tinhvan Japan Co., Ltd. has no access to your content at all.
Deployment Security
SaaS
Data residency in the region you select (Vietnam, Singapore, Japan, Germany)
Tenant-isolated data, enforced by database row-level security
Four-level role-based access control with a hash-chained, append-only audit log
On-Premise
Runs entirely inside your own infrastructure
You control access, TLS termination and storage encryption
Tinhvan Japan Co., Ltd. has no access to your content
Private Cloud
Dedicated deployment - no shared infrastructure
Customer-controlled network boundary
Tinhvan Japan Co., Ltd. has no access to your content
Reporting a Vulnerability
If you discover a security issue, please disclose it responsibly to tvj.sale@tinhvan.com with “NexusIQ – Security” in the subject line. No separate security mailbox has been published yet; this is the single confirmed channel and reports are routed to the engineering team. We publish no acknowledgement or remediation deadline, because we are not yet staffed to guarantee one and would rather say so than make a promise we could not keep. Please give us the chance to respond before disclosing an unpatched issue publicly.