Built for operations that can't afford surprises.
Security in VioletNexus isn't a bolt-on. Server-side tenant isolation, role-based permissions, and audit logging are foundational to how the platform is built. This page describes the practices we actually implement — and is honest about what we do and don't claim.
What we do not claim
VioletNexus does not claim third-party compliance certifications or attestations that it has not independently obtained — including SOC 2, ISO 27001, PCI DSS, and HIPAA. We describe the engineering practices we implement, not audits we have not completed. If your business requires a specific certification, please contact us so we can discuss your requirements directly rather than imply coverage we don't have.
Defense built into the platform, not around it.
These are the concrete measures VioletNexus implements across the stack — from the database up to the response headers.
Tenant isolation
Multi-tenancy is enforced in the database with PostgreSQL row-level security. Every query is scoped to the tenant on the server — isolation isn't left to application code to remember.
Role-based access control
Granular permissions gate every action and are checked server-side. The client never decides what a user is allowed to do.
Audit logging
Sensitive actions are recorded with correlation identifiers, so you can trace what happened, when, and by whom.
Verified webhooks
Inbound provider events are signature-verified, idempotent, and replay-safe, so duplicated or forged events can't corrupt your data.
Encrypted credentials
Integration credentials are encrypted at rest and scoped to their purpose, kept server-side and never exposed to the browser.
Secure sessions
Authentication uses secure, hardened session cookies with sensible defaults for modern browsers.
Input validation & output encoding
Inputs are validated at the server boundary and output is encoded to defend against injection and cross-site scripting.
Security headers & CSP
Responses ship with security headers and a content security policy to reduce the blast radius of client-side risks.
Hardened containers
Services run in non-root, minimal containers to shrink the attack surface of the runtime.
Health & readiness checks
Health and readiness endpoints support safe deploys and quick detection of degraded services.
Least privilege by default
Permissions, credentials, and access scopes follow least-privilege principles across the platform.
Idempotent, replay-safe operations
Payment and webhook flows are designed to be idempotent so retries and replays don't double-charge or duplicate records.
Your data stays yours — enforced in the database.
The strongest isolation boundary is the one the application can't forget. VioletNexus places that boundary in PostgreSQL itself, so tenant separation holds even if application code has a bug.
How isolation is enforced
- Every row belongs to a tenant, and row-level security enforces that boundary in the database engine itself.
- Server-side permission checks run before any action, independent of what the client requests.
- Integration credentials are encrypted at rest and only decrypted server-side when needed.
- Audit entries carry correlation identifiers so related actions can be traced end to end.
Security is a partnership.
We build and operate the platform securely. You control access within your workspace. Both matter.
- Row-level tenant isolation in the database
- Server-side permission enforcement
- Encrypted integration credentials
- Signature-verified, idempotent webhooks
- Security headers, CSP, and hardened containers
- Audit logging with correlation
- Who you invite and the roles you assign
- How permissions map to your team
- Which integrations you connect
- Strong credentials and access hygiene
- Your content, records, and configuration
- When to review your audit trail
Found something? We want to hear about it.
If you believe you've discovered a security issue, please reach out so we can investigate and address it. We take reports seriously and appreciate coordinated disclosure.
Run your business on a platform built to protect it.
Isolation, permissions, and auditability come standard — on every tier.