Trust

Security

Last updated: 20 July 2026

Nexum Ledger is compliance infrastructure for regulated firms. Security is not a feature of the product; it is the product. This page summarises how the platform is protected and how to report a vulnerability to us.

Platform security

  • Encryption in transit. All traffic is served over HTTPS with certificates managed automatically. Plain HTTP is not served.
  • Encryption at rest. Every compliance event is encrypted under its own unique 256-bit key (AES-256-GCM) before storage. A full database exfiltration yields no readable customer content.
  • Authentication. Passwords are hashed with Argon2. Sessions use short-lived JSON Web Tokens. Every API route is authenticated and scoped to the owning account.
  • Tamper evidence. Events are hash-chained (SHA-256) in an append-only store with database-level triggers blocking updates and deletes. Merkle roots are anchored to Bitcoin via the OpenTimestamps protocol, so proofs are verifiable independently of us.
  • Memory-safe engineering. The backend is written in Rust, eliminating entire classes of memory-corruption vulnerability by construction.
  • Hosting. UK-hosted infrastructure with continuous deployment, uptime monitoring, and webhook payloads signed with HMAC-SHA256.

Reporting a vulnerability

We welcome good-faith security research. If you believe you have found a vulnerability in nexumledger.com or any Nexum Ledger service, please email jsjjd3690@gmail.com with enough detail to reproduce the issue. Our disclosure reference is published at /.well-known/security.txt.

  • We acknowledge reports within 3 business days.
  • We aim to triage within 7 days and to remediate confirmed issues on a timeline proportionate to severity, keeping you informed.
  • We will not pursue or support legal action against researchers who act in good faith: test only against systems we operate, avoid privacy violations and service disruption, and give us reasonable time to remediate before public disclosure.
  • We do not currently operate a paid bounty programme; we credit researchers who wish to be named.

Scope

In scope: nexumledger.com and its subdomains, the Nexum Ledger API, and official integrations we publish. Out of scope: denial of service, social engineering, physical attacks, and third-party services we do not operate.

Nexum Ledger Ltd, registered in England and Wales, company number 17001897. Nexum Ledger is not a law firm and is not regulated by the SRA; compliance decisions remain the responsibility of the client firm.