A plain account of the controls that protect nexgenehub.com and the data in it, the limits we have not solved yet, and the certifications we do not hold. Written for procurement and security reviews, and reviewed whenever the platform changes.
How to read this page
5
Available today
2
Conditional
3
Not available
We do not use “planned” or “coming soon” labels for security. A priority without an approved date is listed as a priority, not a promise.
5 are available today, 2 depend on a setting or a supplier, and 3 are not built. Each card links to the section that explains it. Reviewed 29 October 2026.
HTTPS on every page, one-year HSTS with subdomains, www redirected to the apex domain, and a Content Security Policy on every response.
Read the detailRow-level security policies scope each customer to their own plans, requests, invoices, AI usage and profile records.
Read the detailStaff permissions are granted per module and enforced by database policies, not by hiding buttons in the interface.
Read the detailAdmin changes are written by database triggers, searchable by permitted staff, and exportable a page at a time as CSV.
Read the detailTime-based one-time passcodes are available to every staff account; the account owner decides whether they are compulsory.
Read the detailCustomer accounts sign in with a password or Google today. A second factor for customer accounts is not built.
Read the detailSAML single sign-on and SCIM directory provisioning are not available, and we do not pretend otherwise in tenders.
Read the detailPer-connection request limits run in production, with tighter per-account limits on AI, upload and export routes.
Read the detailThe enquiry form relies on a hidden honeypot field, a submission-timing check and a per-connection limit instead of a CAPTCHA.
Read the detailBackups are provided by our infrastructure suppliers. We have not yet run and recorded a restore drill of our own.
Read the detailAccess is enforced in the database, not just in the interface. A staff member without permission for a module is refused by policy even if they construct the request themselves.
These gaps are also listed as improvement priorities below, without dates we cannot keep.
Data protection here means the transport, the storage boundary, the keys and the lifecycle. Where a control belongs to a supplier rather than to us, it is labelled that way.
All pages are served over HTTPS with HTTP Strict Transport Security for one year including subdomains, and insecure requests are upgraded.
Every response also carries clickjacking protection, MIME-sniffing protection, a strict referrer policy and a restrictive browser-permissions policy.
Encryption at rest is provided by our database and hosting suppliers. We have not independently audited their storage controls.
Their current commitments are available on request. We do not claim encryption-at-rest details beyond what those suppliers state.
AI provider and payment API keys are held only in server-side configuration. Provider keys are never sent to the browser.
The Content Security Policy pins outbound connections to our own origin and our Supabase project, so a compromised script cannot quietly post data elsewhere.
Production requests are limited per connection, with separate and tighter allowances for API routes than for page loads.
AI requests, uploads and exports also carry per-account limits. The enquiry form adds a hidden honeypot field and a submission-timing check.
1Collected
Account details, business profile, the content you submit to a tool, billing records and support messages.
2Used
To run the feature you asked for, keep your subscription and records accurate, and meet tax and accounting duties.
3Retained
Administrative audit events default to 730 days, adjustable by us within a 30 to 3,650 day window. Financial and legal records follow their own statutory periods.
4Exported or erased
A data access request produces an export of your records. Erasure is reviewed and recorded rather than executed blindly, so that legally required records survive.
AI features send selected content to a third-party model. This section states exactly what leaves the platform, what consent we record, and what we do not claim.
1You select content
Only the material the action needs is queued for the request.
2You confirm consent
A separate, versioned notice for workspace AI, OCR or voice.
3The provider responds
The configured model generates the result on our servers, never in the browser.
4We record the event
The consent version is stored with the usage record for that request.
We send the content selected for that action, not your whole account. CSV insights send column names and a sample of up to 20 rows, never the full dataset.
Workspace AI actions, OCR and voice transcription each require a separate confirmation before content is sent. The consent version is recorded server-side with the usage event so the exact notice you agreed to can be identified.
AI requests go to the provider configured for the platform, currently Google's Gemini API. Providers act as sub-processors under our Data Processing Agreement; the current list is available on request.
Managed service deliverables are reviewed by a person. Automated workflow steps can be held for approval, and every step leaves evidence you can inspect.
Our AI Usage Notice states that customer data is not used to train foundation models without explicit consent. Provider processing and retention remain subject to that provider's terms and configuration.
The Data Processing Agreement covers provider roles and sub-processors.
Ask for the current provider and sub-processor list, or send a security questionnaire through the contact page. We answer in writing.
Contact SecurityNexGen eHub Limited is registered in the United Kingdom. Some of the suppliers that run the platform are not, and our back-office team is not. We would rather name that than imply a UK-only footprint.
The company and the contract
NexGen eHub Limited is registered in England and Wales. Contracts, billing and primary accountability sit here.
Hosting, database and AI providers
Our platform is hosted with suppliers that may process data outside the United Kingdom, and the AI provider processes the content submitted for a request outside the UK.
Back-office support
Support staff access only the information needed to respond to your request and are bound by the same confidentiality obligations as our UK team.
Where personal data is transferred outside the UK we rely on a transfer mechanism permitted by UK GDPR, such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You can request details of the specific mechanism that applies to your data.
Administrative activity is recorded by database triggers, so the record does not depend on a member of staff remembering to log it.
Changes to tickets, client requests, leads, billing and subscription records, plan catalogue pricing and allowances, AI usage events, staff roles and assignments, credit adjustments, agreement publishing, website content, AI configuration and personal-data access requests including exports.
Each event records the actor, the entity and the time. Plan catalogue pricing and allowance changes also record the previous and new value. Customer profile edits record which fields changed, never the values.
Authorised staff can search and page through the log. The staff console has no edit or delete path for audit events.
Any page of results can be exported as CSV. Events older than 730 days are pruned hourly by the scheduled job, and the window can be set between 30 and 3,650 days.
The scheduled job prunes audit events hourly. Financial and legal records live in their own tables and are not touched by that routine.
Authorised staff can read the trail in the staff console. Customers cannot read another account’s events, and the trail is not exposed publicly.
This is the honest order of work. Each priority exists because a control above is missing or depends on someone else, and none of them has an approved delivery date.
October 2026
Per-connection rate limiting moved into production, with stricter limits on API routes than on page loads.
October 2026
Audit-log retention added as a service-role-only routine, defaulting to 730 days and refusing windows outside 30 to 3,650 days.
October 2026
Staff module permissions enforced in database policies across staff-accessible tables.
October 2026
Content Security Policy moved to a per-response nonce with inline script attributes blocked.
October 2026
Server-side request forgery protections and upload body-size caps added to outbound fetch and upload routes.
No external assessment has been carried out, so our internal review is the only evidence we have.
Backups are supplier-run; restoring one ourselves is the only way to know the recovery path works.
We have no published procedure or tested rehearsal for a security incident.
Customers can use a passcode today only for staff console access, not for their own accounts.
Larger organisations cannot yet federate access or revoke it from their own directory.
Public forms currently rely on a honeypot, timing and rate limits rather than a challenge.
Procurement reviews often ask for the whole trail, and we can only export a page at a time.
We hold no certification, and would rather earn one than display a badge we have not been awarded.
If a priority matters for your procurement or compliance review, contact us and we will tell you honestly what we can commit to and by when.
Ask about a priorityWe do not describe the platform as certified, accredited or independently assured. This page is our own account of our controls, and it is written so that a reviewer can check it rather than trust a badge.
No information security management system has been certified.
The assessment has not been completed.
No independent SOC 2 report exists.
Security here is a split of duties, not a claim that we cover everything on your behalf.
Reporting a vulnerability
If you believe you have found a security issue, tell us through the contact page. We publish a security.txt file so automated scanners and researchers can find the right route.
Published contact route
/.well-known/security.txt
We do not publish an email address here. The contact form routes your message to the team that reads security reports.
These are the questions a security review usually asks first. Each answer matches the detail above, and nothing here is softened to sound better.
Reviewed 29 October 2026.
Ask a questionNo. We hold none of those certifications and do not describe the platform as certified. We list the certifications we do not hold, and the controls we do have, so a reviewer can judge the evidence rather than a badge.
Not yet. No external assessment has been carried out. An independent penetration test is our first improvement priority, and we would rather say so than imply assurance we have not bought or earned.
Staff accounts can enrol a time-based one-time passcode today, and the account owner can make it compulsory for the staff console. Customer accounts have no second factor yet; a password or Google sign-in is the only option.
Our platform is hosted with suppliers that may process data outside the United Kingdom, and the AI provider processes submitted content outside the UK. Back-office support is provided from Ahmedabad and Thiruvananthapuram in India. Row-level security policies scope customer records to their own account, and staff access is granted by role and recorded in the audit trail.
Our AI Usage Notice states that customer data is not used to train foundation models without explicit consent. A workspace AI action, OCR or transcription sends only the selected content to the configured provider, and records the consent version with the usage event. Provider processing and retention are subject to that provider's terms and configuration.
Administrative audit events default to 730 days and are pruned hourly by the scheduled job; the window can be set between 30 and 3,650 days. Authorised staff can search and page through the log and export any page as CSV. There is no single bulk export of the entire log.
We investigate, contain the issue and inform affected customers, and the Information Commissioner's Office where the law requires it. We have not yet published or rehearsed a formal incident-response runbook, and that is listed as a priority rather than presented as a finished procedure.
No. SAML single sign-on and SCIM provisioning are not available. Accounts are created by invitation, and a client organisation cannot yet federate access or revoke it from its own directory.
Report a vulnerability through the contact page; our security.txt file at /.well-known/security.txt points to the same route. The Data Processing Agreement and the current sub-processor list are available on request, and the DPA is published on this site.
Need an answer that is not here? Send a security questionnaire through the contact page and we will reply in writing.
Every document below is published on this site and linked directly, so a reviewer is never asked to request a copy of something that should already be public.
What we collect, why we hold it and the rights you can exercise.
Our processor terms, sub-processors and international transfer mechanism.
How AI features handle your content, consent and prohibited uses.
What may and may not be done with the platform and its content.
The contract that applies to your account and subscriptions.
The cookies and browser storage we use, and what they are for.
Send them directly. We would rather reply with a specific answer, or an honest “not yet”, than leave a gap in a procurement review.
Vulnerability reports, security questionnaires and DPA requests all reach the same team.
This page describes our current practices and is reviewed as controls change. It is not an independent verification or certification of those controls, and it does not replace the contract, the Data Processing Agreement or legal advice.
