Security and hosting
Your agency's data, and only your agency's
Nelxa is multi-tenant software. These are the boundaries we build and test, described plainly.
Row-level security per agency
Every record carries its agency and PostgreSQL row-level security enforces the boundary. Our build includes lints that fail when code reads a tenant-scoped table without scoping it.
Hosting in the European Union
The PostgreSQL database runs in Frankfurt, Germany. The application runs on Google Cloud in the EU. Uploaded files live in Firebase Storage under server-controlled, per-agency paths; direct client access is denied.
Sign-in and sessions
Staff sign in with email and password or Google. Sessions are server-verified cookies; API routes check the user, the agency and the role on every request.
Traveller access without passwords
Portal links are personal tokens with expiry; one-time codes are sent by email, rate-limited and checked for reuse. A portal session sees one traveller's trip only.
Documents that do not change
A signature stores the document version and the money snapshot it was given for. Signed PDFs reprint that snapshot, and later edits create new versions.
Recoverable deletion and logs
Deleted records go to a trash that can be restored before purge. Automation runs and signatures are logged with who, what and when.
Secrets stay secret
Agency AI provider keys are encrypted at rest with AES-256-GCM. Error messages shown to users never repeat internal or provider errors.
Your own domain, isolated
Premium workspaces can serve traveller pages on their own domain; the domain is verified and bound to one agency, and cross-domain requests are checked for origin.
Documents that do not change
A signature stores the document version and the money snapshot it was given for. Signed PDFs reprint that snapshot, and later edits create new versions.
Frequently asked questions
Where is my data stored?
In the European Union: the database in Frankfurt and the application and file storage in EU Google Cloud regions.
Can another agency ever see my clients?
No. Agency scoping is enforced by row-level security in the database and by checks in every API route, and automated lints guard the code.
Do you offer single sign-on?
Not yet. Staff sign in with email and password or with Google. Ask us if SSO matters for your agency.
Questions about security?
Write to us and a person who works on the product will answer.
hello@nelxa.comReady to run your agency on Nelxa?
Set up your workspace in minutes. Free during beta; founding customers get 30% off for 12 months when public pricing launches.
Or email hello@nelxa.com for a walkthrough.