Security

Tenant isolation

Nearwise is multi-tenant. Every record is scoped to your organization, and each request is checked against your membership before any data is read or written, so one customer can never see or modify another's data.

Credential encryption

Google OAuth tokens are encrypted at rest with AES-256-GCM using a dedicated encryption key that is independent of our session-signing secret. Tokens are decrypted only in memory to make the API calls you initiate.

Access controls

Roles (owner, admin, member) govern what each teammate can do. Publishing to public listings and destructive changes are restricted to owners and admins, and member edits can be routed through a maker-checker approval queue so a second person reviews changes before they go live.

Transport & application security

• HTTPS everywhere, HSTS, and a strict Content-Security-Policy with per-request script nonces.
• Rate limiting on authentication and expensive actions to blunt abuse and credential stuffing.
• Email verification and session revocation on password reset.
• Server-side error tracking so failures are detected rather than silent.

Reporting a vulnerability

If you believe you have found a security issue, please email security@nearwise.co. We appreciate responsible disclosure and will work with you to resolve it.