Security and data protection
This is how we protect this site, and how we approach security on our clients' projects.
No certifications we don't have — just what we can show you, and what we put in writing with you.
How we protect this site
Verifiable measures, applied to the very site you're visiting.
- HTTPS across the entire site, with HSTS (Strict-Transport-Security) to always force an encrypted connection.
- HTTP security headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy) and a Content-Security-Policy (CSP) that limits which scripts, styles and connections the site can load.
- No third-party script runs without your consent: our cookie notice separates essential and analytics cookies, and only loads Google Analytics if you accept that category.
- Self-hosted typography (Inter): no requests are made to Google Fonts, so your browser never reveals your IP to that provider just by reading the site.
- Contact and newsletter forms are submitted through Formspree and include a hidden honeypot field to discard automated spam submissions.
- We collect the minimum data needed to answer your message or send you the content you requested.
Full detail on what data we collect, what we use it for and how to exercise your rights is in our Privacy Policy (Colombian Law 1581 of 2012), which identifies the data controller and the email to exercise your rights of access, correction, deletion or consent withdrawal.
How we approach security in your projects
Principles we always apply, and topics we define with you before starting.
Security by design
We consider it from day one of every project, not as an afterthought before delivery.
Your infrastructure when the project requires it
For applied AI projects, we can process your data on your own infrastructure or private cloud, or use open-source models when you need that level of control.
Legacy modernization with defined roles
For legacy modernization, the migration is carried out by a specialized strategic partner and Nextsoft delivers new modules, integrations, frontend and QA. What each team does and what access it needs to your systems is defined in writing in the project agreement, and the transition is planned in phases, in parallel with the current system.
Everything else is agreed in writing, project by project
Confidentiality, the scope of access to your systems, data handling and environment separation (development, testing, production) are defined and put in writing in each project agreement, according to your internal policies and your industry's.
Questions to ask any software vendor
A generic, useful checklist — whichever software vendor you're evaluating.
- 1Who is responsible for processing my data, and how can I contact them?
- 2What access does the provider's team need to my systems, and for how long?
- 3How is confidentiality (NDA) formalized, and what exactly does it cover?
- 4Where is my data hosted, and under which jurisdiction?
- 5What third-party dependencies (libraries, open-source packages) do they use, and how do they audit and update them?
- 6How do they separate development, testing and production environments?
- 7What happens to my data and access once the contract ends?
We go deeper into this checklist in How to Evaluate an Enterprise Software Vendor in 2026. And if you're curious about the risk of the open-source dependencies any vendor uses, check our analysis of the npm supply-chain attack (ChainDrop).
Frequently asked questions
Honest answers to what we're usually asked about security.
Does Nextsoft hold certifications like ISO 27001 or SOC 2?
Today we don't have any published formal certifications. What we can show you is how we protect this site (above on this page) and how we approach security in each project: confidentiality, access and data handling are defined and put in writing before we start.
Do you sign non-disclosure agreements (NDAs)?
Confidentiality terms are defined as part of each project agreement, based on what you need. It isn't a generic document — its scope is discussed with you case by case.
Where do you process data on applied AI projects?
It depends on the project: we can process your data on your own infrastructure or private cloud, or use open-source models when the level of control you need requires it. This scope is defined with you before we start.
What happens if an open-source library you use has a vulnerability?
We closely follow cases like the npm supply-chain attack we documented on our blog (ChainDrop, 2026). Dependency management and updates are part of the technical scope agreed in each project.
How do I know if a software vendor is trustworthy on security?
Below on this page we share a checklist of concrete questions, and on our blog a more complete guide to evaluating enterprise software vendors.
Have specific security requirements?
Tell us what you need and we'll define it together in writing before the project starts.