Trust Center

Security at Nesgate

Last updated: 8 October 2026

In short

• Sensitive information is checked and hidden on the employee’s own computer. It is never sent to Nesgate.
• Our servers only store summaries, such as “card number hidden in ChatGPT at 10:42”.
• Each company’s data is kept separate, stored in Singapore and encrypted.
• If something goes wrong, we inform you within 48 hours.

The rest of this page gives the technical detail your IT or security team may ask for. The contractual commitments are in the Data Processing Agreement.

Architecture: inspection on the device

• Every prompt, file and photo is checked inside the browser extension, before it is sent to an AI app.
• The raw text, files and images never leave the device. The console receives only metadata: the type of data, the action taken, the AI app, the time and a masked preview.
• Customer and employee lists are turned into one-way hashes in the browser before upload.
• If the console cannot be reached, local protection keeps running.

See Privacy by design for exactly what stays and what goes.

Hosting and isolation

• Managed service hosted in Singapore, with per-tenant isolation: each organization sees only its own members’ data.
• Hosting in Indonesia and an ISO 27001 / SOC 2 programme are on our roadmap. We will update this page when they are in place.

Protecting the service

• Encryption in transit (TLS 1.2+) and of secrets at rest.
• Backups encrypted with a key that is not stored on our servers, with tested restores.
• Least-privilege database access and no open server ports.
• Logging and alerting of errors and security events.
• Strict browser security headers on this website, including a Content Security Policy that blocks inline scripts.

Account security

• Passwords are stored as bcrypt hashes; we cannot read them.
• Two-step verification and passkeys for every console account. Business and Enterprise can require two-step verification for the whole team.
• Single sign-on (OIDC) and automatic provisioning (SCIM) on Enterprise.
• Admin, Analyst and Employee roles on Business and Enterprise.

Audit and transparency

• Every incident and admin action is recorded in a hash-chained, tamper-evident audit log.
• Our own support actions appear in your audit log.
• Extension packages on the download page come with a SHA-256 fingerprint so you can verify them.

Sub-processors

• DigitalOcean: hosting, database and encrypted off-site backups (Singapore region).
• Cloudflare: network and protection against attacks.
• Email provider: account and alert emails.
• Payment partner: online payments only; card numbers never reach Nesgate.

New sub-processors are announced to administrators at least 30 days in advance.

Incidents and data breaches

We notify affected customers without undue delay, and in any case within 48 hours of becoming aware of a personal data breach, so they can meet their own 3 × 24-hour obligation under Indonesia’s Personal Data Protection Law (UU PDP).

Report a vulnerability

If you believe you have found a security issue in Nesgate, please email [email protected] with the subject “Security report”, steps to reproduce and the impact you observed. Please give us reasonable time to fix the issue before sharing it publicly, and do not access other customers’ data. We will acknowledge your report and keep you updated.

Questions

Security questionnaires and procurement reviews: [email protected].