Security and privacy overview

• Encryption in transit using TLS, and encryption at rest for stored data and uploaded files.
• Managed, regularly backed-up infrastructure with monitoring and centralised logging.
• Backups cycled on a rolling schedule so restorations remain possible after incidents.

• Row-level security so each organization can only reach the records its roles permit.
• Role-based permissions from board level down to site supervision, per module and per record.
• Least-privilege administrative access, with privileged actions written to the audit trail.
• Project-level participation controls governing what partner organizations can see.

• Email and password sign-in with a minimum password length and breach-aware validation.
• Email verification before an account becomes active.
• Sign-in with Google or Apple, using only the minimum identity scopes required.
• Secure session handling with sign-out that clears cached workspace state.

Submissions, approvals, revisions, certificate issues and administrative actions are time-stamped and attributable to a named user, so the project record can be reconstructed for close-out, audit or dispute avoidance.

If you believe you have found a vulnerability, please report it to security@projectnexusenterprise.com with enough detail to reproduce the issue, and allow us reasonable time to investigate before public disclosure. Please do not access, modify or exfiltrate other users' data while testing.

How personal data is collected, used, shared, retained and deleted is described in the Privacy Policy. Platform obligations for both parties are set out in the Terms of Service.

ProjectNexus Enterprise does not claim any security certification, accreditation or independent audit report. This page describes the controls that are implemented; any formal certification will be published here only once it has actually been obtained.