Security

NerveCall is built on a modern, multi-layered cloud infrastructure designed for security, resilience, and scale:

• Supabase — Managed PostgreSQL database with automated backups, point-in-time recovery, and high availability.
• Cloudflare — Global CDN, DDoS mitigation, Web Application Firewall (WAF), and edge caching for all traffic.
• Vultr — Compute infrastructure for SFTP ingestion endpoints and background processing workers.

All infrastructure components are monitored 24/7 with automated alerting for anomalies, performance degradation, and security events.

• In Transit: All data between your browser and our servers is encrypted with TLS 1.3. API communications and third-party integrations use authenticated HTTPS connections.
• At Rest: Database data is encrypted at rest using AES-256. Backups and snapshots inherit the same encryption standards.
• Application Layer: Sensitive fields such as authentication tokens and credentials are hashed or encrypted before storage.

• Supabase Auth: Secure, password-based authentication with bcrypt hashing, automatic session rotation, and refresh token management.
• Multi-Factor Authentication (MFA): Available for all accounts. We strongly recommend enabling MFA for administrator users.
• Password Policy: Minimum complexity requirements enforced at registration and password reset.
• Session Management: Sessions expire automatically after periods of inactivity. Users can revoke sessions from their account settings.

• Row Level Security (RLS): Every database table enforces RLS policies ensuring users can only access data belonging to their organization.
• Role-Based Access: Granular roles (Admin, Manager, Viewer) control what actions users can perform and what data they can see.
• Tenant Isolation: Each customer workspace is logically isolated. No cross-tenant data access is permitted at the application or database level.

Call Detail Records are among the most sensitive data we handle. We apply additional protections:

• CDR data is isolated per tenant and never mixed or aggregated across customers.
• Ingestion via SFTP uses scoped credentials that are limited to a single tenant directory.
• Raw CDR files are processed and then removed from temporary storage within 24 hours.
• Audit logs record all access to CDR tables for compliance and forensic review.

For customers using SFTP to upload CDR files, we maintain strict security standards:

• SSH-2 Protocol: All SFTP connections use SSH-2 with strong cipher suites and key exchange algorithms.
• Scoped Credentials: Each tenant receives unique SFTP credentials that are restricted to their isolated upload directory.
• IP Allowlisting: Customers may optionally restrict SFTP access to specific source IP addresses.
• File Validation: Uploaded files are scanned for integrity and format compliance before processing.

• SOC 2: We are actively working toward SOC 2 Type II certification. Our controls, policies, and monitoring infrastructure are designed to meet SOC 2 trust service criteria.
• Data Processing: We process data in accordance with our Privacy Policy, which outlines retention, deletion, and data subject rights.