Security
How Nixelo protects your workspace.
The controls built into Nixelo today: sign-in and two-factor authentication, roles, audit logs, API-key limits, and encrypted connections.
Free during early access
Practices
What is in place today.
Sign-in
Sign in with email and password or with Google. Passwords are stored as salted scrypt hashes.
Two-factor authentication
Turn on authenticator-app codes for your account, with eight backup codes for recovery.
Roles and memberships
Organizations have owner, admin, and member roles, and projects have admin, member, and viewer roles.
Audit logs
Organization admins can search and export the organization audit log, and each person can review their own activity.
API keys and IP allowlists
API keys are shown once, stored hashed, rate-limited, and can be rotated or revoked. Admins can limit API-key requests to listed IP addresses or ranges.
Encrypted connections
The site is served over HTTPS with HSTS, and app pages set a content security policy.
Hosting
The backend runs on Convex, and the web app is served from Railway.
Questions
Reporting and data handling.
How do I report a security concern?
Email [email protected], the contact published in the privacy policy, with what you found and how to reproduce it.
Where is data handling described?
The privacy policy covers what Nixelo collects, the service providers it uses, retention, and your rights.
Good to know
- Nixelo has no compliance certification, such as SOC 2 or ISO 27001.
- Single sign-on with SAML or OIDC is not available yet.
- There is no public bug bounty program.
Early access
Bring one real piece of work.
Start with a single brief and follow it all the way to the update.
Free during early access