Security isn't a feature we bolt on — it's how the platform is built. Below is a plain-English summary of the safeguards in place today. Questions or a vulnerability to report? Write to contact@nxcart.io.
Encryption
- In transit — all traffic is served over HTTPS with TLS 1.2 or higher.
- At rest — data is stored with AES-256 encryption.
- Secrets — gateway keys and other sensitive credentials are encrypted at the application layer with environment-specific keys, separate from the database.
Payments — we don't hold card data
Card payments are processed by Razorpay, a PCI-DSS compliant payment gateway. Full card numbers never reach our servers — we store only the last four digits and the card brand for reference. That keeps the most sensitive data out of our systems entirely.
Tenant isolation
Nxcart is multi-tenant by design: each store's data and media are isolated and access-controlled. One merchant can never see or reach another merchant's data.
Access control & monitoring
- Internal access follows the principle of least privilege — staff get only what their role requires.
- Access is logged and monitored, and reviewed periodically.
- Admin sessions are protected with CSRF tokens and secure, HTTP-only cookies.
- Sensitive admin areas support two-factor authentication.
Infrastructure
Infrastructure runs on Amazon Web Services (primarily the Mumbai region) for reliability and capacity.
Data protection & privacy
We handle personal data in line with India's Digital Personal Data Protection Act, 2023 and the IT Act / SPDI Rules. For shopper data, we act as a Data Processor on the merchant's behalf under our Data Processing Addendum. See our Privacy Policy for what we collect and your rights.
Incident response
We maintain a process for detecting and responding to security incidents. If a personal-data breach affects you, we will notify the Data Protection Board of India and affected individuals in the manner and within the timelines required by law.
Responsible disclosure
If you believe you've found a security vulnerability, please tell us first — email contact@nxcart.io with the details and steps to reproduce. We'll acknowledge your report, investigate, and keep you updated. Please don't publicly disclose an issue until we've had a reasonable chance to fix it.
Your part
Security is shared. Use a strong, unique password, enable two-factor authentication, keep your staff access list current, and never share credentials. Together that keeps your store safe.