Security overview

Three principles guide how we run our systems. Least privilege — only the people and tools that need access to a given system have it, and that access is reviewed periodically. Boring infrastructure — we prefer mature, well-understood components (Plesk, nginx, Apache, GitHub, Let’s Encrypt) over novel ones. Honesty about scope — we describe the controls we actually have today, not the controls we hope to have one day.

The public website is served from a Plesk-managed Ubuntu 24.04 LTS server. nginx is the public-facing web server, with Apache providing static-file fallback when needed. TLS certificates are issued and auto-renewed by Let’s Encrypt. The HTTP-to-HTTPS redirect is enforced at the server level, so every request that reaches the application is encrypted. The server is hardened following the standard Plesk and Ubuntu guidance: unattended security upgrades are enabled, the firewall is closed by default, and SSH is restricted.

The website itself is built and deployed automatically from our private GitHub repository. Each commit on the production branch triggers a fresh build and graceful restart, so the version of the site running in production matches the version that has been reviewed in source control.

Production server access is limited to a small number of named individuals using strong, unique credentials and two-factor authentication where the platform supports it. The GitHub organisation that hosts our source code is configured to require two-factor authentication for all members, and external collaborators are added on a per-repository basis with the minimum permissions needed to do their work. We review access lists on a periodic basis and remove access promptly when a person’s role changes.

When you take part in an AI Value Realisation Sprint or a similar engagement, the information you share with us is handled under the engagement agreement and the data processing terms that accompany it. We work in private, access-controlled folders that are scoped to the specific engagement. Where the work involves AI initiatives, we treat the use-case names, value scoring, evidence, and outcomes as confidential by default and do not publish them without explicit, written client consent (typically as an anonymised case study).

We do not place client production data into public services. Where AI tooling is used in the course of an engagement, we limit input to anonymised or non-sensitive context and discuss the use of that tooling with the client first.

Application secrets (such as API tokens used to deploy the site) are not committed to source control. They are stored in the deployment platform’s secret manager and referenced by name from configuration files. Personal access tokens used for machine-to-machine integrations are scoped to the minimum permission needed and given a finite expiry; expired tokens are rotated promptly.

We use a small set of well-known service providers to operate the business. Today this includes our Plesk-managed hosting provider for the public website, our email provider for business correspondence, and a small number of cloud productivity tools for documents, scheduling, and analytics. For client engagements we name the relevant sub-processors in the engagement agreement and give clients the opportunity to object before work starts. We do not knowingly transfer client data to sub-processors who do not meet equivalent levels of protection.

If we discover a security incident affecting our systems, we triage it, contain the impact, and investigate the root cause. We notify affected clients without undue delay and, where the incident is reportable, we notify the UK Information Commissioner’s Office within the applicable statutory timeline. We then write up the incident, fix the underlying cause, and capture the lesson learned in our internal runbook so the same class of incident is harder to repeat.

If you believe you have discovered a security issue with this site or with any service we operate, please email admin@nexuscove.com with “Security disclosure” in the subject line. Please give us a reasonable window to investigate and remediate before disclosing publicly. We will acknowledge serious reports promptly and credit reporters who would like to be named.

For any security question that is not a vulnerability disclosure, the same address works: admin@nexuscove.com.