Security
Controls should protect records, not decorate a page.
Nexora applies account, authorization, storage, and financial-record controls to the actions supported by the platform.
Account access
Passwords are securely hashed. Authentication sessions are regenerated at sign-in, expire after inactivity, and use protected cookies. Repeated sign-in attempts are rate limited and recorded.
Financial integrity
Balances are calculated from server-side ledger entries. Deposits, investments, maturity processing, and withdrawals use database transactions and idempotency keys to prevent duplicate money movement.
Authorization
Investor records are scoped to the signed-in account. Administrator routes verify explicit permissions on the server. Sensitive financial decisions are written to audit history.
Documents and sensitive data
Supported uploads are validated by size, MIME type, and file signature, assigned random storage names, and kept outside public web directories. Withdrawal destination details use authenticated encryption at rest.
What you can do
Use a unique password, verify that you are on the expected Nexora address, never share your password, and contact support if an account or destination change is unfamiliar.