Security Architecture
ESG data often precedes public financial disclosures, so NexESG is built to keep each organisation's data separate, to record who changed what, and to delete it completely when you ask. This page describes what is in place today.
Encryption and Hosting
Your data is encrypted at rest with AES-256 and travels only over encrypted HTTPS connections. The database and uploaded documents are stored in Singapore, on managed infrastructure whose providers are independently audited under SOC 2 Type II.
Isolation Enforced by the Database
Separation between organisations is not left to the application alone. It is enforced inside the database itself with PostgreSQL Row Level Security: every request carries the signed-in user's session token, and the database returns only the rows that user's organisation is entitled to see. Administrative actions such as changing roles, settings or branding are restricted to your organisation's administrators.
Strict Corporate Boundaries
Access rules mirror your corporate structure. Headquarters can read its subsidiaries' data for consolidated reporting, while subsidiaries cannot see each other's information. Within an organisation, department users work only in the areas an administrator has assigned to them.
Sign-In Protection
Every user can turn on two-factor authentication, so signing in also needs a code from an authenticator app. Once it is on, the database itself refuses a session that has not supplied the code. Repeated sign-in and sign-up attempts are rate-limited, and passwords are stored only as salted hashes.
Audit Trail and Review
Submitted figures pass through a maker-checker review before they are approved. Every change to a figure is recorded in an audit log with who made it and when; the log is written by the database itself and cannot be edited or deleted by any user. Review comments can be changed only by the person who wrote them.
How AI Features Use Your Data
Document scanning, AI review and narrative drafting send only the content needed for the task to our AI provider, over an encrypted connection. Your data is not used to train AI models, and our provider is contractually prohibited from using it to train theirs. The provider may retain requests for a limited period for abuse monitoring before deleting them; these requests are processed in the United States, as set out in our Privacy Policy.
Data Sovereignty
Your sustainability data remains yours. On request, or 90 days after access is ended, we permanently delete your organisation's records, documents and user accounts. Deletion cannot be undone, so please export anything you wish to keep beforehand.