Security at Nilorax
Your financial data is among the most sensitive information you manage. Here is exactly how Nilorax protects it.
How we protect your data
Multiple layers of protection working together so you can trust the platform with your most sensitive information.
Encryption in Transit
All communication between your browser and Nilorax is encrypted using HTTPS (TLS). Data sent over the network — including your login credentials and financial records — cannot be intercepted in plain text by third parties.
Password Protection
Passwords are never stored in plain text. We apply a strong cryptographic hashing algorithm with a unique salt per user before storing credentials. Even in the unlikely event of a database compromise, your password cannot be recovered from the stored hash.
Secure Authentication
Nilorax uses JSON Web Tokens (JWT) with automatic expiry for session management. Tokens are scoped to your account and validated on every API request. Google OAuth sign-in uses the industry-standard OAuth 2.0 protocol — we never see your Google password.
Rate Limiting
Login, registration, and password-reset endpoints are rate-limited per IP address. This protects your account against automated brute-force attacks that attempt to guess your password through repeated rapid requests.
Security Headers
Every response from Nilorax includes a comprehensive set of HTTP security headers: Content Security Policy (CSP), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and — in production — HTTP Strict Transport Security (HSTS). These protect against cross-site scripting, clickjacking, and content injection attacks.
Privacy-First Infrastructure
Nilorax does not integrate third-party analytics, advertising networks, or tracking pixels. There are no external scripts running in your session that could exfiltrate your data. The only third-party connection permitted is Google's authentication service, and only when you choose to sign in with Google.
Security practices
Beyond the headline features, security is embedded throughout the development process.
Sensitive endpoints are protected by authentication middleware — unauthenticated requests are rejected with a clear error before reaching any data.
All authenticated API requests are logged to an immutable audit trail, so you can see every action taken in your account.
Backup files (if enabled) are stored with access controls and can be encrypted at your discretion.
Database access is restricted to the application layer. Direct database connections from external networks are not permitted.
Dependencies are monitored for known security vulnerabilities and updated on a regular schedule.
Error messages are designed to avoid leaking sensitive implementation details to potential attackers.
What we will never do
Privacy and security require commitments about what we don't do, not just what we do.
Sell your financial data to third parties, data brokers, or advertisers.
Use your data to profile you for targeted advertising.
Store your plain-text password anywhere in our system.
Share your account information with government or third parties except where required by law.
Access your financial records without your explicit consent (e.g. for a support ticket you raised).
Embed third-party advertising or tracking scripts in the application.
Responsible Disclosure
We appreciate the work of security researchers who help keep Nilorax and its users safe. If you discover a potential security vulnerability in Nilorax, we ask that you report it to us privately before disclosing it publicly, so we have the opportunity to investigate and address the issue.
To report a security issue, please contact us through our secure contact form with a description of the vulnerability, steps to reproduce it, and the potential impact. We will acknowledge your report promptly and keep you informed as we investigate.
We commit to: acknowledging your report within 5 business days, keeping you informed of our progress, and crediting you (with your permission) when the issue is resolved.