What we can put in writing about your data
You are handing NxtWave Hiring candidates' names, phone numbers and resumes. This page is written for the person on your side who has to sign off on that, so it names the control we actually rely on and the assurances we do not have yet.
How one workspace is kept out of another
Separation is enforced where the query is built, not by asking every developer to remember a filter.
The boundary we rely on today
Every row carries the workspace it belongs to. The storage layer appends that predicate to each query as the query is built, rather than trusting roughly 560 call sites to remember it, and it stamps the same workspace onto every insert. A write whose payload names a different workspace than the request is refused rather than corrected. Above that, each action is gated by a capability check and a role scope check, so a signed-in user reaches only the roles and records their grants cover.
The second layer, being switched on
Postgres has restrictive row-level security policies keyed on a workspace claim carried in the access token, and the token hook that mints that claim re-derives it every hour from live memberships. Those policies are not what keeps workspaces apart today, because the application connects to Postgres with a service role that bypasses them. We are moving query families onto a user-scoped connection behind a separate flag, one family at a time, and we would rather tell you that than describe a control we do not yet lean on.
Where your data is
India, in one region, for everything we store.
- Database
- Postgres in AWS Mumbai, in the ap-south-1 region.
- Application
- Vercel's Mumbai region, bom1.
- Candidate documents
- Object storage in the same region as the database. Resumes and offer files never leave it.
- Leaving the region
- Mail, WhatsApp and voice reach candidates through vendors whose delivery networks are global. The content of a message leaves India in the same sense that any email does. Your records do not.
Consent, export and deletion
The four moments a data protection reviewer asks about, and what the product does at each.
When a candidate applies
Consent is recorded as an event with its timestamp and the source IP address it came from, alongside the application. It is a stored fact you can produce later, not a checkbox that leaves no trace.
When you ask for your data
A workspace export produces one CSV per table plus the uploaded files and a manifest with per-table row counts, delivered as a signed download link. You do not have to ask us to write a query for it.
When you leave
Deletion runs in two steps, thirty days apart. Access stops the moment it is requested and the request can be cancelled during those thirty days, so a mistake is recoverable. After that the rows are purged rather than flagged, along with the stored files and any login that belonged to no other workspace.
If a workspace is switched off
One status field governs every entrance at once, so sessions, careers pages, webhooks and scheduled jobs all refuse it in the same instant. A suspended careers page answers 403, because the workspace exists and can be turned back on. An archived one answers 404, because nothing should confirm it ever existed.
What we do not have yet
A security page that lists only strengths tells you nothing. Here is what a reviewer will ask for and not get.
No SOC 2 report and no ISO 27001 certificate
We have not been audited against either standard. If your process requires one before signing, we are not through it yet, and we would rather you know now than at the end of a procurement cycle.
No independent penetration test to show
We have not commissioned a third-party test, so there is no report to send you. We will do one before we claim to have done one.
No uptime commitment
We do not publish an availability number and we will not put one in a contract we cannot yet measure ourselves against.
Row-level security is not the enforced boundary yet
The policies exist and deny by default. The application still connects as a service role, so they are a second layer we are adopting, not the one holding the line today.
DPDP rules are still settling
India's Digital Personal Data Protection Act, 2023 is the law we build to. Parts of it are still being operationalised, and our commitments will move with it rather than ahead of it.
Questions, and reporting a problem
Send a security questionnaire and we will answer it in the same register as this page: what we do, and what we do not.
If you believe you have found a vulnerability, write to us before disclosing it anywhere else. Tell us what you did and what you saw, and give us a way to reach you. We will confirm we received it, and we will tell you what we found.
Reading this before a demo
Bring your security reviewer to the call. Walking through a real workspace answers more of a questionnaire in half an hour than a document exchange does in a week.
The contractual version of all of this lives in the terms, which are in draft while counsel reviews them.