Account safety
Use a unique password, keep access to your email account secure, sign out on shared devices and never share verification codes. NEXFIN staff should never ask for your password, OTP or UPI PIN.
NEXFIN / SECURITY CENTRE
Security Centre
Security information for NEXFIN website visitors and client portal users, including responsible disclosure and account-safety guidance.
Private client records
Client pages are intended to require authenticated access. Supabase Row Level Security and private storage policies must be verified using separate client and administrator test accounts before real records are stored.
Responsible disclosure
Provide a monitored security contact before launch. Report suspected vulnerabilities with the affected page, steps to reproduce and impact. Do not access, modify, download or disclose another person’s data while testing.
Operational safeguards
The operator should maintain dependency updates, least-privilege access, administrator MFA, database backups, audit-log review, incident response procedures and a documented restoration test.
Service limitations
A public website and client portal cannot guarantee that every threat will be prevented. Do not upload highly sensitive documents until the operator has completed a security and privacy review.
Security contact
Insert a verified security reporting email and escalation process. Do not publish a contact address until it is monitored.
Owner review required: This page is a publishing draft, not legal advice or a final contractual policy. Confirm the operating legal entity, jurisdiction, contact details, retention periods, procedures and applicable laws with qualified counsel before publishing or collecting personal information.