The security page that tells you what we have not done yet.
Every vendor security page lists encryption and access control. The useful part is the boundary — what is protected, what is not covered, and which claims we are not entitled to make. This page covers all three.
How the platform is built.
Tenant isolation, enforced server-side
The business workspace is the tenant boundary. Every query and command is scoped to it on the server, and the workspace identifier is never read from a request body. A dedicated isolation test suite runs forever after, not once at launch.
Authorization on every operation
Each protected operation checks the authenticated user, business membership, permission and subscription entitlement. Hiding a button in the browser is a UX nicety, never the control.
Encryption in transit and at rest
TLS everywhere with HSTS, and platform encryption on the database, file storage and message queues.
Least-privilege identities
Separate managed identities for the API, the background worker and the migration job, each holding only the permissions it needs. The application identity cannot alter the database schema.
Uploads treated as hostile
Logos and attachments are validated on detected type rather than the declared one, size-limited, renamed server-side, stored in private containers, malware-scanned, and served only through time-limited signed URLs. SVG is not accepted as a logo, because SVG can carry script.
Secrets never in the repository
Secrets live in Azure Key Vault, reached through managed identity. No secret appears in source control, infrastructure templates or pipeline configuration.
Where your data actually lives.
All application data is pinned to Microsoft Azure’s Canada Central region: the PostgreSQL database, your uploaded logos and attachments, the message queues, the email service and the application telemetry. This is configured in infrastructure, not policy, so it cannot drift.
The part most vendors would leave out
Sign-in is delegated to Microsoft Entra External ID. Entra directories in our subscription may be provisioned outside Canada, which means the record of your login identity — not your invoices, clients or documents — may be held outside the country. We are stating that rather than advertising "all your data stays in Canada", because that sentence would be easier to write and less true. If precise residency of identity data matters to your organization, ask us before you sign up and we will tell you exactly what the directory holds.
We do not store your password.
There is no custom authentication system in NextiaInvoices. Authentication is delegated entirely to Microsoft Entra External ID — which means there is no password database here to breach.
Sign in the way you already do
Google, Microsoft, Apple, or email and password. Multiple providers can be linked to one account, and removing one is only allowed while another valid method remains.
Multi-factor authentication
Available and encouraged for every customer. Mandatory — not optional — for Nextia platform administrators and support staff.
Reauthentication for what matters
Changing your email, linking or unlinking a provider, changing your password, deleting your account, changing your subscription, adding an administrator, or changing MFA all require a fresh sign-in.
Recovery that gives nothing away
Account-recovery messages never reveal whether an email address has an account. Auth endpoints are rate-limited and abuse-protected.
The link your client opens is the biggest external surface. We treat it that way.
Every invoice and quotation has a public view reached without a login, which makes that token the most exposed thing we operate. Its design reflects that.
At least 256 bits of entropy
Generated with a cryptographically secure random generator. Guessing one is not a practical attack.
Stored hashed
The raw token is shown to you once and never persisted, so a database copy does not hand over anyone’s documents.
Not enumerable
An invalid token and a revoked token return the same response, through a constant-time lookup, rate-limited per token and per address.
Revocable and scoped
Rotate or revoke a link at any time from the invoice. The view returns that one document and your branding — never an adjacent record, never another client.
A trail that cannot be quietly edited.
Audit rows are written in the same database transaction as the change they describe — an audit write that fails rolls the action back, because an unaudited sensitive change is worse than a failed one. The application has no update or delete path to the audit table, and its database role is not granted those privileges.
- Sign-in, sign-out and failed sign-in
- MFA enabled, disabled, reset or challenged
- Provider linked or unlinked
- Business created or updated
- Team invitation and role change
- Client, service and tax changes
- Invoice created, finalized, sent or cancelled
- Payment-status change
- Quotation acceptance
- Payment-URL change
- Subscription change
- Support access and impersonation
- Data export and deletion request
What we are entitled to say — and what we are not.
Our own specification forbids claiming a compliance posture we have not achieved. So here is the split, plainly. We would rather lose a deal to a competitor with a certification than win one with an implication.
- Designed around Canadian privacy expectations
- Designed for GDPR-style data-subject rights: export, deletion, retention
- Application data resident in Azure Canada Central
- Audit logging, tenant isolation and least-privilege access built in from the start
- Dependency scanning and static analysis blocking every build
- SOC 2 — not audited
- ISO 27001 — not certified
- PIPEDA certification — no such certification is claimed
- Penetration-test report — not yet available to share
Who else touches the data.
A short list, kept short deliberately. Each entry exists because the alternative was building it ourselves worse.
| Sub-processor | Purpose | Region |
|---|---|---|
| Microsoft Azure | Application hosting, database, file storage, queues, telemetry | Canada Central |
| Microsoft Entra External ID | Authentication and identity directory | See the residency note above |
| Azure Communication Services | Transactional email delivery to you and your clients | Canada Central |
| Stripe | Our own subscription billing — never your clients’ payments | Global (Stripe-controlled) |
| Cloudflare | This marketing website and its content delivery | Global edge network |
Where is my data stored?
All application data — the database, your uploaded files, the message queues and the application logs — is pinned to Microsoft Azure’s Canada Central region. Sign-in is handled by Microsoft Entra External ID, and the directory holding your login identity may be provisioned outside Canada; we state that plainly on the security page rather than rounding it up to a claim we cannot support.
Do you store my password?
We never see it. Authentication is delegated entirely to Microsoft Entra External ID — sign in with Google, Microsoft, Apple, or email and password. There is no custom authentication system in NextiaInvoices, and no password for us to lose.
Are you SOC 2 or ISO 27001 certified?
No, and we will not imply otherwise. The platform is designed around Canadian privacy expectations and GDPR-style data-subject rights, with audit logging, tenant isolation and least-privilege access built in from the start — but a certification is a completed audit, and we will claim one only when we have one.
Can I export or delete my data?
Yes to both. You can export your personal and business data, and you can request account deletion. Some records survive deletion because they legally have to — subscription transaction history, security events tied to abuse investigations, and audit entries for administrative actions. That is written in the privacy policy rather than discovered later.
Who at Nextia can see my invoices?
Support access is restricted, requires multi-factor authentication, and is audited. Impersonating a customer account is a logged action with a recorded reason, not a quiet capability.
Found something? Tell us before you tell the internet.
If you believe you have found a security vulnerability, email us with enough detail to reproduce it. We will acknowledge you, keep you updated while we fix it, and credit you if you would like to be credited. We will not pursue legal action against good-faith research that avoids privacy violations, data destruction and service disruption.
Report a vulnerability — security@nextiainvoices.comSend your first invoice in under five minutes.
Set up your business, add a service, and bill a client — all before your coffee gets cold.
14-day free trial · No credit card at sign-up · Your data is preserved if the trial ends