Trust

Security and your data

What a security review needs to know about nxip: where your data lives, who processes it, how it is protected, and where the gaps are. Each statement here is checked against the service as it runs today. Where something is not in place yet, this page says so.

Status

nxip is setting up a public status page for the API, the dashboard and this website atstatus.nx-ip.com, and will link it here once it is live.

Until then, a scheduled check from outside nxip’s infrastructure tests the API and this website regularly, and opens an issue for the founder in a private repository when either is down. Its results are not public. Separately, Fly.io checks every 15 seconds that the API answers and can reach its database.

nxip does not publish an uptime percentage and does not offer an uptime guarantee.

Where your data lives

Location

The live database is in London: the API and the database run on Fly.io in its London region. Backups are stored with Tigris, restricted to London and Amsterdam, so your pools, subnets, addresses and account data stay in the UK and the EU. Billing and email are handled by Stripe and Google, both US companies; thesub-processor list says what each one holds. The website and the dashboard run on Cloudflare’s global network, at the location nearest each visitor, and Cloudflare also sits in front of nxip.dev, the API’s address.

Encryption

In transit: the API, the website and the dashboard all redirect plain HTTP to HTTPS and send an HSTS header. Traffic between the API and the database stays on Fly.io’s encrypted private network, and the database has no public address.
At rest: the database volume is encrypted, and the backups are stored encrypted by Tigris.
Keys and links: API keys, and the sign-in, signup and invitation links nxip emails, are stored only as one-way SHA-256 hashes. A key is shown once, when it is created, and cannot be recovered afterwards, by you or by nxip.
Payment cards: never reach nxip. Stripe takes them on its own checkout page.

Backups

The database takes a full backup every day and archives its changes continuously, at least once a minute. Backups are kept for 7 days, in Tigris object storage restricted to London and Amsterdam.
A restore has not yet been tested. Until one has, treat the backups as unproven.
There is one database machine, with no automatic failover. If it fails, nxip is down until it is recovered or restored from backup.
A move to a managed database, with a standby and automatic failover, is planned. It has no date yet.

Sub-processors

These are the only vendors that process customer data for nxip. Changes to this list are published here before they take effect.

Last updated: 19 September 2026

Vendor	What it does for nxip	Data it sees	Where
Fly.io	Runs the nxip API and its database.	Everything nxip stores: account details, your pools, subnets and addresses, API key hashes and the audit log.	London, United Kingdom. Fly.io is a US company.
Tigris	Stores the database backups, as Fly.io’s object storage partner.	Full copies of the database, so everything Fly.io holds.	Restricted to London and Amsterdam, so the backups stay in the UK and the EU. Tigris Data Inc. is a US company, and its data processing agreement incorporates the UK Addendum to the Standard Contractual Clauses.
Cloudflare	Serves nx-ip.com and the dashboard, sits in front of nxip.dev (the API), and runs the signup challenge (Turnstile).	Every request to nx-ip.com, the dashboard and nxip.dev passes through it, and it decrypts HTTPS at its edge before passing the request on, so it sees their content, including API requests to nxip.dev.	Global network, served from the location nearest you. Cloudflare is a US company.
Stripe	Takes payment for paid plans.	The billing details you enter on Stripe’s own checkout page, including card details. nxip receives your email address, your subscription status and Stripe’s references for your customer record and subscription, never card details.	United States company, global service.
Resend	Sends verification, sign-in, invitation and product update email.	Your email address and the content of those emails, including one-time sign-in links.	Sent from Resend’s EU (Ireland) region. Resend is a US company.
Google Workspace	Hosts our mailbox. Mail to hello@nx-ip.com is delivered to, and our replies are sent from, Google Workspace.	Email you send us, and our replies.	Google is a US company with a global service. The Google Workspace data processing addendum applies, which incorporates the Standard Contractual Clauses with the UK Addendum, and Google LLC also certifies under the EU-U.S. Data Privacy Framework and its UK Extension.
Sentry	Records errors from the API, the dashboard and this website, so they can be fixed.	Error reports: the error, the code that raised it, and details of the request that caused it, which can include request headers. Sentry’s option to collect personal data such as IP addresses and cookies is off.	EU (Germany) data region. Sentry is a US company.

How nxip is built to protect your data

Your organization is the boundary. Every table of organization data (pools, subnets, addresses, API keys, users and the audit log) carries the id of the organization it belongs to, and every lookup by id is filtered by it. Asking for another organization’s record returns 404 Not Found, the same answer as a record that does not exist, so ids cannot be probed.
Role-scoped keys. Every user and every API key has its own role (Owner, Admin, Member or Read-only), so a pipeline’s key needs no more access than its job. Only an Owner can create keys. Every new key expires, at most 90 days after it is created.
No passwords. Sign-in is a single-use link sent by email, valid for 15 minutes. A dashboard session lasts up to seven days, held in one essential cookie that is encrypted, markedHttpOnly so scripts in the page cannot read it, Secure so it is sent only over HTTPS, and SameSite=Lax. nxip sets no tracking, analytics or advertising cookies anywhere.
An audit log. Every change to pools, subnets, addresses, keys, invitations and organization links is recorded with which fields changed, who made the change and from where. You can read your own log through the API and in the dashboard. Sign-ins, accepted invitations and billing events are in it too, recorded with no signed-in session behind them, so they show an actor of system.
Rate limits. The API limits requests per IP address and per organization. Signup is limited per IP address and protected by Cloudflare Turnstile. Sign-in link requests are limited per email address and per IP address.
Validated input. API routes check their input against declared schemas before the route’s own code runs. The payment webhook from Stripe is checked by its signature instead.
Security headers. The API sends HSTS, X-Content-Type-Options,X-Frame-Options and a no-referrer policy. The dashboard refuses to be framed by any other site.
Secrets kept out of logs. The API removes API keys, authorization headers and cookies from its request logs.
Errors are tracked. Server-side errors in the API, the dashboard and this website’s server routes are reported to Sentry.
Checked dependencies. Every API change is tested in CI, and fails on any dependency with a known high or critical vulnerability.

Security questionnaire answers

The questions a vendor security review usually asks, answered in plain text. Where the answer is no, it says what exists instead. For anything not covered here, emailhello@nx-ip.com.

Hosting and data location

Where is customer data stored?: The live database is in London: the API and the database run on Fly.io in its London region. Backups are stored with Tigris, restricted to London and Amsterdam, so customer data stays in the UK and the EU. No pool, subnet, address or account data is stored outside the UK and the EU. Billing and email are handled by Stripe and Google, both US companies; see sub-processors for what each one holds.
Can we choose the region our data is stored in?: No. There is one region for every customer: the live database is in London, and its backups are restricted to London and Amsterdam.
Is our data kept separate from other customers’ data?: Logically, yes; physically, no. All customers share one database. Every table of organization data (pools, subnets, addresses, API keys, users and the audit log) carries the id of the organization it belongs to, and every lookup by id is filtered by it. Records made before an organization exists, such as a pending signup or a sign-in link, are keyed by email address or token instead. See how nxip is built to protect your data. There is no dedicated database per customer today.
Can we export our data?: Yes. Everything you create in nxip (pools, subnets, addresses and their metadata) can be read back through the API, at any time and on every plan.
What happens to our data when we leave?: Email hello@nx-ip.com to close your account, and we delete your organization and everything in it: pools, subnets, addresses, users, API keys and the audit log. Copies in the database backups are removed as those backups pass the 7-day retention window. The API’s request logs, which Fly.io holds, are not deleted with the account: they expire under Fly.io’s log retention, which its log search sets at 7 days.

Access control and authentication

How do users sign in to the dashboard?: With a single-use link sent to their email address, valid for 15 minutes. nxip has no passwords.
Do you support multi-factor authentication?: No. Because sign-in is a link sent to your email, the security of an nxip account rests on the security of that mailbox, including any multi-factor authentication your organization enforces on it.
Do you support single sign-on (SAML or OIDC)?: No. OIDC single sign-on is on the roadmap, with no date yet.
Do you support role-based access control?: Yes. Every user and every API key has one of four roles: Owner, Admin, Member or Read-only. Only an Owner can create API keys. See API keys and roles.
How are API keys managed?: Each key is shown once, when it is created, and only a one-way hash of it is stored. Every new key expires, at most 90 days after it is created, and any key can be revoked at any time.
Who at nxip can access production systems and customer data?: One person, the founder, has access to the production infrastructure and the database. Nobody else does, and every account that reaches them requires multi-factor authentication.
Is access to the infrastructure protected by multi-factor authentication?: Yes. Every account that can reach nxip’s infrastructure, source code or payment settings requires multi-factor authentication, either on the account itself or through the identity provider used to sign in to it, which enforces it.

Encryption

Is data encrypted in transit?: Yes. nxip.dev, nx-ip.com and app.nx-ip.com all redirect a plain HTTP request to HTTPS and send an HSTS header, so a browser that has seen any of them once will not try plain HTTP again. Between Cloudflare and the API the connection is HTTPS as well. Inside Fly.io, traffic between the API and the database runs over Fly.io’s encrypted private network, and the database has no public address.
Is data encrypted at rest?: Yes. The database volume is encrypted, which Fly.io reports for it and describes as block storage encryption. Tigris encrypts the data it stores, including the backups.
How are credentials and secrets stored?: API keys, and the sign-in, signup and invitation links nxip emails, are stored only as SHA-256 hashes, so a copy of the database does not contain a usable key or sign-in link. Service secrets are held in Fly.io’s and Cloudflare’s secret stores, not in the code or the database.
Do you store payment card data?: No. Card details are entered on Stripe’s own checkout page and never reach nxip.

Backups and recovery

Is customer data backed up?: Yes. The database takes a full backup every day and archives its changes continuously, at least once a minute, to Tigris object storage. Backups are kept for 7 days.
Has a restore from backup been tested?: No. A restore has not yet been tested. Until one has, treat the backups as unproven.
Is there high availability or automatic failover?: No. The database is one machine, and the API normally runs on one machine. If the database machine fails, nxip is down until it is recovered or restored. A move to a managed database with a standby and automatic failover is planned, with no date yet.
What are your recovery point and recovery time objectives?: No formal objectives are committed. With changes archived at least once a minute, the design allows recovery to within about a minute of a failure, but that has not been proven by a restore test.
Do you offer an uptime SLA?: No. The Free plan comes with no uptime or durability guarantee (see Terms, section 5). See status for how availability is checked.

Logging and monitoring

Do you keep an audit log of customer activity?: Yes. Every change to pools, subnets, addresses, API keys, invitations and organization links is recorded with which fields changed, which key and user made the change, and their IP address and user agent. For some changes, such as an address’s hostname and status, the old and new values are recorded too. Sign-ins, invitations being accepted and billing events are recorded too. It records changes and account events, not every request. Your organization can read its own log through the API (GET /v1/audit-log) and on the dashboard’s Activity page. It is kept for the life of your account, and deleted with it.
Are sign-ins and billing events in that log?: Most of them, yes. Signing in, requesting a sign-in link for an address that has an nxip account, accepting an invitation, and the four billing events (an upgrade, a change of subscription, a cancellation and a failed payment) all become rows you can read. What does not is anything that happens before your organization exists: a signup request, a sign-in link requested for an address with no account, and a checkout by somebody who does not have an nxip account yet. Those have no organization to belong to, so they stay in the operational logs held by Fly.io, which are described below. nxip writes the recorded ones without a signed-in session behind them, so none of them is linked to a user record: the dashboard shows the actor as system, and where a person is involved their email address is in the row’s details.
Do you keep request logs?: Yes, for operating the service. The API logs each request, including the caller’s IP address and user agent, to Fly.io. Those logs are kept under Fly.io’s log retention, which its log search sets at 7 days, and are not deleted when an account is closed.
How do you detect problems?: Server-side errors in the API, the dashboard and this website’s server routes are reported to Sentry. Errors inside your browser are not. Fly.io checks every 15 seconds that the API answers and can reach the database. A scheduled check from outside nxip’s infrastructure tests the API and this website regularly, and opens an issue for the founder in a private repository when either is down.
Do your logs contain secrets?: The API removes API keys, authorization headers and cookies from its request logs before they are written.

Incident response and breach notification

Do you have an incident response process?: Yes, and it is short because nxip is run by one person. An alert from monitoring, error tracking or a report goes to the founder, who contains the problem, fixes it, tells affected customers, and then writes down what happened and what changed so it cannot recur. There is no written runbook beyond that yet.
How quickly will you tell us about a breach that affects our data?: Without undue delay, and within 72 hours of confirming it, by email to your organization’s owners, saying what happened, what data was involved and what we are doing about it.

Vulnerability management and secure development

How do you check dependencies for known vulnerabilities?: Every change to the API is checked in CI against the npm advisory database, and fails on any known vulnerability rated high or critical. The website and the dashboard do not have this check yet.
How are changes tested before release?: Every change to the API runs its automated test suite, a type check and a check that the database schema matches its migrations, in CI, on every pull request and every push to the main branch. Releases to the API are run by hand, never automatically from a push.
How is input validated?: API routes validate their input against declared schemas before the route’s own code runs, and reject input that fails them. The payment webhook from Stripe is checked by its signature instead. Request bodies are capped at 1 MB.
Do you have abuse protection?: Yes. The API limits requests per client IP address and per organization, with the organization limit set by plan. Signup is limited per IP address and protected by a Cloudflare Turnstile challenge. Requests for sign-in links are limited per email address and per IP address.
Has nxip had a penetration test?: No third-party penetration test has been done yet. Dependency scanning runs in CI on every change.

People

How many people work on nxip?: One. nxip is built and run by its founder, a sole trader in the United Kingdom.
Do staff with access to customer data have background checks?: The founder, the only person with access to customer data, holds a current DBS check, which can be provided on request.
How are the devices used to run nxip secured?: The one laptop used to run nxip has full-disk encryption, a screen lock and automatic operating system updates.
Do staff receive security training?: There is no formal training programme, because there is one person, the founder.

Compliance certifications

Do you have a SOC 2 report or an ISO 27001 certification?: No, neither, and no audit has been started. See compliance for what the hosting providers hold.
Will you sign a data processing agreement?: Yes. Email hello@nx-ip.com and we will provide one, as the privacy policy says.
Are you registered with the ICO?: nxip is confirming whether the UK data protection fee applies, and will register if it does.

Compliance

nxip holds no SOC 2 report or ISO 27001 certification today, and no audit has been started.

The providers nxip runs on hold their own:

Fly.io, which runs the API and database, has a SOC 2 Type II report, and says its hardware runs in ISO 27001 certified data centres.Fly.io compliance.
Cloudflare, which serves the website and dashboard and sits in front of nxip.dev, has a SOC 2 Type II report and ISO 27001 certification.Cloudflare compliance resources.

Their certifications cover their own platforms, not nxip’s software or how nxip is run.

Reporting a security issue

Email hello@nx-ip.com with what you found and how to reproduce it. Please do not access or change data that is not yours while testing, and give us a chance to fix the issue before you publish it.

The founder reads every report, replies within 3 working days to confirm it has arrived, and keeps you updated until it is fixed. We will not pursue legal action over good-faith security research. nxip does not run a paid bug bounty.