Trust Center
Security practices
How we embed security into architecture, delivery pipelines, and operations — from threat modeling to incident response.
Security practices
Secure development, cryptography, identity, observability, and resilience across engagements we deliver and platforms we operate.
Secure SDLC
We aim to bring security requirements into discovery and design so threat considerations guide architecture before code lands.
OWASP practices
Delivery is informed by OWASP Top 10 and ASVS-oriented controls for authentication, session, and input validation.
Threat modeling
For sensitive workflows, we map assets, trust boundaries, and abuse cases — especially payments, PII, and admin surfaces.
Code reviews
We practice peer review on delivery work. High-risk changes are intended to get explicit security checklist coverage before merge.
Static analysis
Where pipelines support it, SAST and lint rules run in CI to catch insecure patterns early.
Dependency scanning
We follow dependency scanning practices for third-party packages; critical CVEs are triaged by severity when identified.
Container scanning
Where container images are used, we aim to scan for known vulnerabilities before promotion to staging and production.
Secrets management
Credentials are intended to live in managed secret stores. We strive to keep secrets out of source control.
Encryption at rest
Managed databases, object storage, and disks use provider-managed or customer-managed encryption keys as agreed per engagement.
Encryption in transit
TLS 1.2+ is the target for public endpoints. Internal service traffic uses encrypted channels where platforms allow.
Authentication
Modern auth patterns including OAuth/OIDC, SSO integrations, and secure session handling where the product requires them.
Authorization & RBAC
Least-privilege role models, resource-scoped permissions, and admin separation of duties by design.
MFA support
Multi-factor authentication is supported for privileged access and recommended for customer admin roles when available.
Logging & auditing
Security-relevant events are logged with retention suited to investigation and compliance needs, as agreed per engagement.
Incident response
We maintain an incident response approach covering detection, containment, communication, and post-incident review for work we operate.
Business continuity
For critical delivery and operated services, we plan for staffing, tooling, and failover paths appropriate to the engagement.
Backup strategy
Backup and restore practices are defined per environment and data class; restore readiness is validated as part of delivery where applicable.
Disaster recovery
RTO/RPO targets are agreed per engagement. Recovery drills are used to validate restore and failover assumptions when in scope.
Security FAQ
Hosting regions, penetration testing, secrets in CI/CD, and vendor questionnaires.
Need a security review?
Email nexorbitlabs@gmail.com for questionnaires, penetration test coordination, or vulnerability reports.