Security

Your school's data is safe with us

Nexa Ed handles sensitive student records and financial transactions. We take that responsibility seriously at every layer of the stack.

Tenant isolation

Every school operates in its own isolated Convex project. No school can read or write another school's data. Tenant IDs are verified on every authenticated request.

Encryption in transit and at rest

All traffic between your browser, our API, and our databases is encrypted over TLS 1.2+. Data at rest is encrypted by our infrastructure providers (Convex, NeonDB).

API key authentication

REST API access requires a per-tenant API key passed via the x-api-key header. Keys are scoped to a single tenant and can be rotated from your dashboard at any time.

Identity via Clerk

User authentication is handled by Clerk. We never store passwords. Sessions are short-lived JWTs verified server-side on every request.

Webhook signing

Every webhook event Nexa delivers is signed with HMAC-SHA256. Requests older than 5 minutes are rejected to prevent replay attacks. See the REST API docs for verification examples.

Rate limiting

All API endpoints are rate-limited per tenant (or per user for RPC routes) using a sliding window algorithm. Limits are clearly documented and communicated via standard headers.

Responsible disclosure

Found a vulnerability?

We appreciate security researchers who disclose vulnerabilities responsibly. If you discover a security issue, please email [email protected] with a description of the issue and steps to reproduce. We will respond within 48 hours and work with you to address the problem before any public disclosure.

Please do not access, modify, or delete data belonging to other users during your research. We operate a good-faith policy — responsible reporters will not face legal action.

Infrastructure & sub-processors

Nexa Ed is hosted on and uses the following trusted sub-processors:

Convex — reactive database and backend (US)
Neon — serverless PostgreSQL (US)
Clerk — user identity and session management
Paystack — payment processing (Nigeria / Africa)
Google Cloud — Document AI OCR processing
Upstash — rate limiting and async queuing
UploadThing — file upload handling
Resend — transactional email delivery

Security questions?

Reach out and our team will respond as quickly as possible.

Email [email protected]

Found a vulnerability?

Please do not access, modify, or delete data belonging to other users during your research. We operate a good-faith policy — responsible reporters will not face legal action.