How we protect your assets — and how to report a vulnerability.
All traffic between the plugin, portals and our backend uses HTTPS/TLS.
Assets and metadata are stored encrypted at rest — Cloudflare R2 object storage and a managed Postgres database.
Uploads use short-lived, single-purpose signed URLs. Backend credentials stay server-side and never ship in the plugin.
Free portals expire after 24 hours; signed-in free portals lock at expiry and are purged 30 days later. We keep only what a portal needs.
Email magic links — we never store passwords. Card data is handled by our payment provider, not by us.
The plugin ships no third-party analytics or advertising trackers.
We follow coordinated disclosure and appreciate a reasonable window to fix issues before they're public.
Email us with steps to reproduce, impact and any proof of concept. Please don’t open a public issue.
You hear back from a person, and we keep you updated as we investigate.
We triage by severity and fix critical issues first, then tell you when it’s resolved.
With your permission, once the fix ships. No paid bug bounty at this stage.
Nexports is independently built and is not currently accredited to formal standards such as SOC 2, ISO 27001, PCI DSS, HITRUST or SSAE 18. We follow the practices above and keep the data we hold to a minimum. Have specific compliance needs? Email security@nexports.in and we'll do our best to help.