Your data, your evidence, secured.
Nexbasira was designed from day one around the strictest European standards: eIDAS for legal weight, GDPR for data protection, ISO 27001 for operational security.
End-to-end architecture.
5 layers of security, from technician's smartphone to 7-year legal archive.
Standards & certifications.
Nexbasira uses Qualified Electronic Signature (QES) as defined by the EU eIDAS regulation. The highest level of electronic signature recognized in Europe, legally equivalent to a handwritten signature.
GDPR
Nexbasira is GDPR-native: data protection is built into the product, not bolted on after. Our DPO (Data Protection Officer) is AFNOR-certified.
27001
Nexbasira is ISO 27001 certified since 2026. Our ISMS covers the entire product scope, infrastructure, HR and business processes. Annual external audit.
For clients in the medical sector or handling sensitive data, Nexbasira offers HDS hosting via OVHcloud, certified by the French Ministry of Health. Available on Enterprise plan.
Audits & attestations.
All our audit reports are available on request for enterprise clients (under NDA).
For your security team.
Concrete answers to the usual checklist. Each line is in code, on this commit — not a marketing wishlist.
Data residency
Cryptography
SHA-256
over canonical JSON envelopes. Previous-link reference per event. Per-session Postgres advisory lock.
RFC 3161 (FreeTSA), OpenTimestamps (Bitcoin). Anchored at session-end + on-demand.
HMAC-SHA256
in t=...,v1=... format. 5-min clock-skew tolerance. Fernet-encrypted secret at rest.
SHA-256
+ SECRET_KEY pepper at rest. Constant-time verify. Soft-revoke preserves the audit trail.
HS256, IP/UA-pinned, time-boxed, scoped to one session + one participant.
PKCS#7/CMS in PDF signature dict. RFC 3161 timestamp over signature value. Subfilter ETSI.CAdES.detached.
Access controls
app.current_org as session-level GUC enforced by middleware on every request.
/Users + /Groups resources.
Operational security
Found something?
We appreciate it. Here are the commitments we make in return, and the secure channel to reach us.
Acknowledgement within 2 business days
Human reply, not an autoresponder. You know we've read it.
Triage and CVE within 5 days
Severity classification, internal ID assignment, remediation queued.
Critical fixes within 7 days
For critical vulnerabilities post-triage. Advisories follow CVE conventions.
Public credit & bounty
Public hall of fame if you wish. Monetary rewards by severity.
Please don't disclose publicly until we've shipped a fix. We keep you posted at every step.
Need the security questionnaire?
CAIQ, VSA, SIG, or your own format — we respond within 5 business days and ship the artifacts (SBOM, pentest reports, attestations).