NextCRM Security
As of May 14, 2026.
1. Infrastructure
- Hosting: Hetzner Cloud, Frankfurt (Germany) — ISO 27001, SOC 2 Type II;
- Cluster: k3s with isolated control planes, regular automatic CVE updates;
- CDN and protection: Cloudflare (WAF, DDoS mitigation, rate limiting);
- Backups: daily to Cloudflare R2, retained for 90 days;
- RPO ≤ 1 hour, RTO ≤ 4 hours.
2. Encryption
- TLS 1.3 for all traffic (TLS 1.0/1.1 disabled);
- LUKS (AES-256-XTS) for server disks;
- SOPS + age for configuration secrets;
- Argon2id with salt for user passwords;
- Auth tokens — short-lived JWTs rotated every 15 minutes.
3. Data Access
Row-Level Security (RLS) in Postgres — every query is automatically filtered by tenant_id. One store's data is physically inaccessible from another account, even in the event of software bugs.
Internal employee access — only via a bastion host with 2FA, restricted by the principle of least privilege, with all actions logged (90 days).
4. Monitoring and Incidents
- GlitchTip for error tracking (self-hosted, on our own infrastructure);
- Prometheus + Grafana for metrics;
- 24/7 alerts for critical events (downtime, access anomalies, raised errors);
- Severity ladder with SLA: P0 (15 min) / P1 (1 hour) / P2 (4 hours) / P3 (24 hours);
- Postmortems for all P0/P1 incidents — published at
status.nextcrm.me.
5. Penetration Testing
We engage independent security auditors twice a year for penetration testing. Test results are private, but we publish a report on resolved critical vulnerabilities on our blog.
6. Bug Bounty
Found a vulnerability? Email us at info@nextcrm.com.ua. Rewards:
- Critical (RCE, full auth bypass) — 50,000 — 200,000 UAH;
- High (cross-tenant data leak) — 20,000 — 80,000 UAH;
- Medium (XSS, IDOR with limited impact) — 5,000 — 20,000 UAH;
- Low (info disclosure with no impact) — 2,000 — 5,000 UAH.
Please do not publicly disclose vulnerabilities before they are fixed (90-day responsible disclosure).