Trust and security · 09
Information Security Policy
NexToCloud · NTC CAPITAL HOLDING S.A.S. · NIT (Colombian tax ID) 902.096.121-7 Version 2.0 · Effective as of: October 20, 2026 · Last updated: October 20, 2026
1. Commitment#
NexToCloud treats security as part of the product. Its objectives are to protect the confidentiality, integrity and availability of customer information, to comply with Law 1581 of 2012 and to continuously improve its controls.
2. True per-customer isolation#
2.1. Each Customer has its own dedicated database, isolated from that of any other customer. An incident in one customer's workspace is contained within that customer's database, and a restore affects only that customer.
2.2. Signed identity. Each user's identity (who they are, which organization they belong to and what role they have) travels in a cryptographically signed token that the Platform verifies on every request. The database to which each operation connects is derived from that token; no user can choose or alter it.
2.3. Server-side authorization. Permissions are validated on the server for every operation, not just in the user interface. Roles (Owner, Administrator, Editor and custom roles) make it possible to apply the principle of least privilege.
2.4. Validation on every request. Each service validates identity and subscription on every request, and calls from the application go through an API gateway.
3. Encryption#
- At rest: databases and backups are encrypted with AES-256. Backup storage does not allow anonymous access.
- In transit: TLS 1.2 or higher on all connections; web traffic travels over HTTPS.
- Credentials: the Customer's integration credentials (for example, WhatsApp or email) are stored encrypted, with keys held in a secrets vault.
4. Credentials, secrets and access#
- Services connect to the databases using managed identities, with no usernames or passwords in code or configuration.
- Secrets are held in a vault with protection against deletion and purging.
- NexToCloud personnel's access to the infrastructure is named (individual), with multi-factor authentication and least privilege, and is reviewed periodically and whenever an identity with access changes.
- Applications can read and write data, but cannot modify database structure or grant permissions.
5. Traceability#
- Authentication events, changes to data and relevant actions are logged.
- Exporting personal data to a file requires a specific permission and is logged (who, when and what).
- Certain operational records, such as encounter closing notes, cannot be edited after they are saved.
6. Backups and continuity#
6.1. Each Customer's information is protected by three independent layers of backup:
| Layer | Frequency | Retention | Protects against |
|---|---|---|---|
| Point-in-time restore | Continuous (transaction log every few minutes) | 7 days | Accidental deletions, user errors, logical corruption |
| Long-term retention | Weekly and monthly | 4 weeks (weekly) · 12 months (monthly) | Incidents detected late |
| Independent copy outside the database | Daily | 90 days | Server loss, account compromise, regional disaster |
Swipe the table to the right to see all columns.
6.2. The daily copy is kept in geo-redundant storage, replicated to a second region.
6.3. Monitoring. If a backup fails, an automatic alert is generated; a second, independent alert is triggered if thirty (30) hours pass without a successful backup.
6.4. Recovery objectives:
| Scenario | Maximum data loss (RPO) | Recovery time objective (RTO) |
|---|---|---|
| Error or deletion within the last 7 days | ≤ 15 minutes | 4 hours |
| Incident detected after 7 days | Up to the last weekly or monthly backup | 8 hours |
| Loss of the primary server or region | ≤ 24 hours | 24 hours |
Swipe the table to the right to see all columns.
6.5. Restores are first performed on a parallel database, which is validated with the Customer before it replaces the database in use.
6.6. Restores requested for reasons not attributable to NexToCloud (for example, mass deletions by the Customer's users) are performed within these times up to two (2) times per year at no cost; additional restores are quoted as a professional service.
7. Infrastructure#
7.1. The Platform runs on Microsoft Azure, in the East US 2 region (United States), with a backup copy replicated in Central US (United States). Microsoft Azure holds ISO/IEC 27001, 27017 and 27018 certifications and SOC 1, 2 and 3 reports; these certifications cover the cloud provider's infrastructure, and application-level controls are NexToCloud's responsibility.
7.2. The infrastructure is defined as code, with controls that prevent the accidental deletion of databases and backups, and with monitoring and alerts on availability, latency, errors and capacity.
8. Secure development#
- Changes are reviewed before deployment, and development, testing and production environments are kept separate.
- Development and testing environments do not use real customer personal data, except anonymized data or with the Customer's written authorization.
- Dependency management and updating of components with known vulnerabilities.
9. People#
- Personnel and contractors with access to information sign confidentiality agreements.
- Access is granted according to role and revoked when the relationship ends.
10. Incident management#
NexToCloud maintains an incident management procedure covering detection, containment, analysis, recovery and lessons learned. Incidents affecting a Customer's personal data are notified to the Customer within seventy-two (72) hours of their confirmation, in accordance with the Data Processing Agreement.
11. Shared responsibilities#
| NexToCloud | The Customer |
|---|---|
| Operate, back up and protect the Platform and the Customer's dedicated database. | Manage its users, roles and permissions. |
| Perform restores within the time frames set out in this Policy. | Safeguard credentials and immediately report any improper access. |
| Notify incidents affecting the Customer's information. | Define the retention periods required by the regulations applicable to its sector. |
| Provide, upon request and once a year, reasonable evidence of compliance with this Policy. | Retain, by its own means, the records the law requires it to keep long-term (for example, medical records (historia clínica)). |
Swipe the table to the right to see all columns.
12. Responsible vulnerability disclosure#
If you identify a potential vulnerability, write to privacidad@nextocloud.ai with the subject line "Security report", including a description and the steps to reproduce it. We ask that you not access third-party data, not degrade the service and not disclose the vulnerability until it has been fixed. Active testing on the Platform requires prior written authorization (Acceptable Use Policy).
Versioned document. Previous versions are retained at nextocloud.ai/legal.