Security

Nexum Ledger is compliance infrastructure for regulated firms. Security is not a feature of the product; it is the product. This page summarises how the platform is protected and how to report a vulnerability to us.

Platform security

• Encryption in transit. All traffic is served over HTTPS with certificates managed automatically. Plain HTTP is not served.
• Encryption at rest. Every compliance event is encrypted under its own unique 256-bit key (AES-256-GCM) before storage. A full database exfiltration yields no readable customer content.
• Authentication. Passwords are hashed with Argon2. Sessions use short-lived JSON Web Tokens. Every API route is authenticated and scoped to the owning account.
• Tamper evidence. Events are hash-chained (SHA-256) in an append-only store with database-level triggers blocking updates and deletes. Merkle roots are anchored to Bitcoin via the OpenTimestamps protocol, so proofs are verifiable independently of us.
• Erasure inside an append-only log. Those two properties usually pull against each other: a store that cannot delete cannot honour an erasure request. Ours resolves it by never needing to delete a row. The hash chain commits to the ciphertext, so destroying the key leaves every stored hash still recomputable while the content behind it is permanently unreadable. Ledger keys are held per data subject, so one destruction reaches every entry about that person. What deliberately survives is the money and the proof, because a firm must still reconcile its client account under the SRA Accounts Rules and still be able to show the log was not rewritten.
• Memory-safe engineering. The backend is written in Rust, eliminating entire classes of memory-corruption vulnerability by construction.
• No tracking on this site. These pages set no cookies, load nothing from a third party, and store nothing in your browser, which is why you were not asked to dismiss a consent banner to read them. You can confirm it from your own developer tools rather than taking our word for it.
• Hosting. UK-hosted infrastructure with continuous deployment, uptime monitoring, and webhook payloads signed with HMAC-SHA256.

Reporting a vulnerability

We welcome good-faith security research. If you believe you have found a vulnerability in nexumledger.com or any Nexum Ledger service, please email founder@nexumledger.com with enough detail to reproduce the issue. Our disclosure reference is published at /.well-known/security.txt.

• We acknowledge reports within 3 business days.
• We aim to triage within 7 days and to remediate confirmed issues on a timeline proportionate to severity, keeping you informed.
• We will not pursue or support legal action against researchers who act in good faith: test only against systems we operate, avoid privacy violations and service disruption, and give us reasonable time to remediate before public disclosure.
• We do not currently operate a paid bounty programme; we credit researchers who wish to be named.

Scope

In scope: nexumledger.com and its subdomains, the Nexum Ledger API, and official integrations we publish. Out of scope: denial of service, social engineering, physical attacks, and third-party services we do not operate.

Compliance decisions remain the responsibility of the client firm.