Security
How we secure Nexus.
We hold administrative access to our clients' systems. Here is how we protect it.
On every internal account
Company laptops only
Nothing standing, nothing permanent
Both sides confirm a code
How we protect access to your systems
Hardware-key authentication
Every Nexus employee signs in with a physical security key. Multi-factor authentication is universal across our accounts, with no exceptions and no opt-outs.
YubiKey on every internal account
MFA everywhere, not just on email
A phishing page that captures a password captures nothing usable
Company devices only
Our engineers cannot sign in from a personal machine. Access is bound to Nexus-issued laptops that we manage, so a stolen credential on an unknown device gets an attacker nowhere.
Nexus-issued, Nexus-managed laptops
No sign-in from personal or unknown devices
Password plus key plus device, or no access
Least privilege, and nothing standing
An engineer gets the access the job requires, and nothing beyond it. Administrative rights are not held permanently: they are elevated for the task and expire afterward. Standing admin access everywhere is how one mistake becomes a full compromise, so it does not exist here.
Just-in-time elevation rather than permanent admin rights
Access reviewed on a regular cycle, not set and forgotten
The same principle we apply inside your environment
Credentials kept separate
Credentials live in a password manager, not in a spreadsheet, a chat thread, or an engineer's memory. Every client environment has its own, so a problem in one never travels to another, and they are rotated on a schedule rather than left to age.
Separate credentials for every client environment
Rotated on a schedule, and whenever someone leaves
Delegated access to Microsoft tenants, so we hold fewer of your passwords at all
Verified before we touch anything
Before a technician works with you, both sides prove who they are. You confirm a code that identifies you, and the technician presents a code that identifies them as ours. If someone calls claiming to be Nexus and cannot produce that code, they are not us.
Your code identifies you to us
The technician's code identifies us to you
No password reset without both
Sign-in locked to where we are
Our staff sign in from known locations and known addresses. Access from outside them is blocked, so a credential that somehow made it out of our hands still cannot be used from an attacker's machine halfway around the world.
Geographic restrictions on where we can authenticate
Sign-in tied to expected networks and addresses
Unfamiliar origins do not get in
Why our security is part of yours
Reaching a client environment means clearing identity, device, credential, and process. Defeating any one of them on its own gets an attacker nowhere.