How secure is my data in Nexora?

Where is my data stored?

Nexora runs on servers in data centres in the European Union. The backup is kept on a separate server. Files such as invoices, attachments, HR documents and bank files are stored in your administration's own database, not on a shared drive. So a backup or export of your administration contains everything.

How do I log in securely?

• Two-step verification is mandatory for every account and cannot be switched off. After your password you enter a code from an authenticator app, such as Google or Microsoft Authenticator. A device can be remembered for seven days. From your office's fixed internet address the code can be skipped; your password is always required.
• A password has at least 12 characters and must not be a commonly used password.
• A session lasts at most twelve hours; in the app for business owners, seven days.
• If you log in on a new device, or someone tries to guess your password, you receive an email. Those emails deliberately contain no links.
• After repeated failed attempts, Nexora temporarily blocks the address they come from. Your own account is never locked because of it.
• Office staff can log in with their Microsoft account if their office has set this up; the code from the app is still required afterwards.

Who sees what?

• For each administration and module (accounting, HR, management, CRM, projects), you decide per role whether someone has no access, can view or can edit. The server checks this on every action, not just the screen.
• An accounting firm only sees its own clients. This separation cannot be switched off.
• Employees only see their own data in My Nexora.
• Nora only answers questions about what you are allowed to see yourself.

How is sensitive data stored?

• All HR documents are stored encrypted: payslips, annual statements, contracts, CVs and personnel files. The BSN is encrypted too, and exports leave out the BSN and IBAN.
• Keys for integrations, such as Mollie, are stored encrypted in the database.
• Every incoming file is scanned for viruses. If in doubt, it is not let in.
• A deleted file stays in your administration's recycle bin for 30 days.
• Every night an encrypted backup of all databases is made and kept for fourteen days on a separate server. Restoring it has been tested.

Can Nexora look into my administration?

Only when that is needed for support, and only by a platform administrator. They must give a reason, can look for at most thirty minutes and cannot change or send anything. The log records who looked, why and which screens. In addition, Nexora records every change: who, when and from which internet address.

What does Nora do with my data?

Nora works within your own permissions and only in your own administration. The models run on Nexora's own AI server, and no data goes to a third-party AI service. Whatever is in an invoice or document, Nora treats as data and never as an instruction. Your data is not used to train general AI models (article 17.3 of our terms and conditions).

What about the GDPR?

• You are the controller and Nexora is the processor. The data processing agreement is Annex 1 to our terms and conditions.
• Nexora does not sell data.
• If a data breach affects your data, we tell you without undue delay.
• We announce a new sub-processor in advance, and you can object.
• If you stop using Nexora, you can download your data for at least thirty days in a common format, such as an audit file (XAF) for your accounting.

Integrations you switch on with your own account, such as Mollie, fall under your own agreement with that party.