Security & data governance
Financial-services firms need more than a reassuring badge. ThirdNexa uses concrete access, isolation, encryption, and accountability controls to protect the records behind vendor oversight.
Control ledger
These statements describe current ThirdNexa controls. They are intentionally specific and do not imply an audit, certification, or customer-selectable hosting region.
01 / Data protection
ThirdNexa encrypts data in transit and at rest, helping protect vendor records, contracts, reviews, findings, and uploaded evidence throughout the platform.
Encryption is part of the platform baseline.
02 / Access control
Authenticator-app multi-factor authentication is mandatory. Role-based permissions and least-privilege internal access limit who can reach firm records and what they can do.
MFA is required on every plan.
03 / Tenant boundaries
Per-firm access rules are enforced at the database layer, not left to page visibility alone. Users see records only for workspaces they are authorized to access.
Consultancy access follows the same firm boundaries.
04 / Accountability
ThirdNexa preserves actor and time information across important oversight activity. Recorded decisions and finding updates keep the rationale and history available for later review.
The firm remains the decision-maker.
Insurance
ThirdNexa LLC carries the policies below. Limits are published here so a firm performing vendor due diligence can check them at a glance. Policy numbers, the certificate, and full policy terms are shared privately with firms that ask.
| Coverage | Limit | Applies to |
|---|---|---|
| Commercial general liability | $1,000,000 per occurrence | $2,000,000 aggregate per policy year. |
| Damage to rented premises | $100,000 | Per occurrence. |
| Personal and advertising injury | $1,000,000 | Per occurrence. |
| Products and completed operations | $2,000,000 | Aggregate per policy year. |
| Medical payments | $15,000 | Per person. |
| Professional liability (errors & omissions) | $250,000 per claim | Claims-made policy; $250,000 aggregate and $2,000 deductible. |
| Cyber liability endorsement | $25,000 per policy year | Security and privacy liability, privacy regulatory defense and penalties, payment-card (PCI) liability, media liability, and cyber extortion; $500 deductible. |
| Additional insured status | Included | Automatic blanket status under the general liability policy. |
Policy period: October 16, 2026 to October 16, 2027. A current certificate of insurance is available on request to firms performing vendor due diligence — contact support@thirdnexa.com.
The limits above are the policy maximums for the stated period, not a guarantee of payment for any particular loss; coverage remains subject to the terms, conditions, and exclusions of the underlying policies. We are evaluating higher standalone cyber limits as the business grows.
What data we hold
Vendor oversight records: vendor profiles, contracts, due diligence reviews, findings, uploaded evidence, and activity history.
Investor or client account records, account numbers, Social Security numbers, or other personal financial information about your customers.
Each firm controls what it uploads.
AI data governance
AI inputs are processed through zero-data-retention endpoints with storage disabled. Customer content is not used to train the models serving ThirdNexa.
Zero retention by the model provider is distinct from ThirdNexa's own records. We retain AI activity information needed for auditability, support, and responsible operation of the service.
Assurance roadmap
Step 1
Customer diligence package
Step 2
Independent penetration test
Planned — target Q2 2027
Step 3
SOC 2 Type I
In preparation — target Q3 2027
Step 4
SOC 2 Type II
Follows Type I
Last updated: October 16, 2026
ThirdNexa is building toward a formal SOC 2 program, an independent penetration test, a customer diligence package, and enterprise identity capabilities. Those items are roadmap commitments—not certifications or controls we claim to offer today.
We do not currently advertise a SOC 2 report, SAML single sign-on, or customer-selectable data residency. Our public language will change only when the corresponding work is complete and documented.
Subprocessors
| Provider | Purpose | Data location |
|---|---|---|
| Lovable | Application hosting and delivery | United States |
| Lovable Cloud | Database, authentication, and file storage | United States |
| Lovable AI Gateway (OpenAI models) | AI document reading and drafting through zero-retention endpoints | United States |
| Lovable email infrastructure | System and reminder email delivery | United States |
| Stripe | Subscription billing and payment processing | United States |
Last updated: October 16, 2026
Incident response and notification
We monitor platform logs, authentication activity, and error reports. When a suspected incident is identified, we contain it, investigate scope, and preserve records of what happened and what we did.
We will notify affected firms within 72 hours of confirming an incident affecting their data, so they can meet their own notification obligations, and share updates as facts are confirmed.
Availability, backup, and retention
Backups: the database is backed up automatically with point-in-time recovery; uploaded files are kept in redundant managed storage.
Recovery: we restore from the most recent clean recovery point and verify firm data boundaries before returning service.
On termination: a firm can download a full data export at any time. A departing firm's records are kept for its chosen retention window (90 days by default), then permanently deleted after ThirdNexa approval.
Report a security concern
Security contact: support@thirdnexa.com
Report suspected vulnerabilities to support@thirdnexa.com. We acknowledge reports within 2 business days.
We’ll answer directly and distinguish current controls from planned work. Our full vendor due diligence package is already published.
