1. Purpose & Scope
This Information Security Policy sets out how VioletNexus, LLC ("VioletNexus", "we", "us") protects the confidentiality, integrity, and availability of the information entrusted to us: our own business information and the data our customers ("Tenants") and their users store in the VioletNexus platform.
It applies to:
- Systems: the VioletNexus platform, Tenant websites we host, our applications, databases, servers, networks, backups, and the development and administration tools used to run them.
- Information: all data we create, receive, process, or store, in any format.
- People: owners, employees, contractors, and anyone else granted access to VioletNexus systems or data ("Personnel").
Our approach follows Zero Trust principles: never trust, always verify; assume breach; and grant least privilege. It is informed by recognized frameworks, including the NIST Cybersecurity Framework and NIST SP 800-207. A plain-language overview is on our Security page; how we handle personal information is described in our Privacy Policy.
2. Roles & Responsibilities
- Company leadership owns this Policy, approves it, provides the resources to carry it out, and accepts or rejects residual risk.
- The Security Lead (designated by leadership) maintains the Policy, oversees controls, coordinates risk assessments and incident response, and reports on security posture.
- System owners are accountable for the security of the systems and data they run, including access approvals and configuration.
- All Personnel must follow this Policy, protect the credentials and data entrusted to them, and report suspected security events immediately.
- Tenants are responsible for managing their own users and roles, protecting their account credentials, and the content they choose to store, as described under Shared Responsibility.
3. Governance & Risk Management
- We identify, assess, and prioritize information security risks at least annually and whenever there is a significant change to our systems, services, or threat environment.
- Each significant risk is recorded with an owner and a treatment decision: mitigate, transfer, avoid, or formally accept.
- Security requirements are considered before new systems, features, or vendors are introduced, not added afterwards.
- This Policy and its supporting procedures are reviewed at least annually and after any major incident.
4. Asset Management & Data Classification
We maintain an inventory of the systems, services, and data stores that make up the platform, each with a responsible owner. Information is classified so it receives protection proportionate to its sensitivity:
- Restricted: credentials, encryption keys and secrets, authentication data, and financial or payment information. Access is limited to the smallest possible set of people and systems, and it must never be stored in source code or sent over unencrypted channels.
- Confidential: Tenant data and their customers' personal information, contracts, and internal security documentation. Access is on a need-to-know basis only.
- Internal: operational information not intended for the public.
- Public: information approved for publication, such as this website.
When data or equipment is no longer needed, it is securely deleted or destroyed so it cannot be recovered.
5. Access Control & Authentication
- Least privilege: people and services receive only the access their role requires. Permissions are role-based and checked on every request, not just at sign-in.
- Unique identities: every person uses their own account. Shared or generic administrator accounts are not used for day-to-day work.
- Strong authentication: passwords are stored only as salted, adaptive one-way hashes, never in plain text. Multi-factor authentication is required for administrative access to production systems wherever it is supported.
- Privileged access: administrative access to production infrastructure uses encrypted, key-based connections over private network paths. Elevated actions are logged.
- Sessions: sessions are protected against hijacking and cross-site request forgery, and expire after inactivity.
- Lifecycle: access is granted on approval, reviewed periodically, changed promptly when a role changes, and revoked promptly when someone leaves.
6. Cryptography & Encryption
- All traffic to VioletNexus websites and APIs is encrypted with HTTPS/TLS using current protocol versions and cipher suites. Unencrypted HTTP requests are redirected to HTTPS.
- Administrative and system-to-system connections between our servers use encrypted channels.
- Secrets such as API keys, database credentials, and tokens are kept out of source code, stored with restricted permissions, and rotated when exposure is suspected or when a person with access leaves.
- Only well-established, industry-standard cryptographic algorithms and libraries are used. We do not create our own cryptography.
7. Tenant Isolation
VioletNexus is a multi-tenant platform. Every Tenant's records carry a tenant identifier, and the platform enforces it on every query, so one Tenant's data is not visible to another. Cross-tenant access happens only when the controlling Tenant explicitly instructs it, or when the law requires it. Administrative tools that span tenants are restricted to authorized VioletNexus Personnel, and their use is logged.
8. Secure Development & Change Management
- Development and testing take place in environments separate from production. Production data is not copied into development without equivalent protection.
- Code follows secure-coding practices, including:
- parameterized database queries;
- validating input and encoding output;
- CSRF protection;
- safe handling of file uploads.
- Changes to production are reviewed, tested, and recorded. Backups or rollback plans are prepared before significant changes are deployed.
- Third-party libraries and components come from trusted sources, are kept up to date, and are monitored for published vulnerabilities.
9. Infrastructure & Network Security
- Servers, databases, web servers, and containers are configured more strictly than their defaults. Unnecessary services, ports, and accounts are removed or disabled.
- Networks are segmented. Services are reachable only by the systems and people that need them, and management interfaces are not exposed to the public internet.
- Security updates are applied on a risk-based schedule. Critical, actively exploited vulnerabilities are prioritized for immediate remediation.
- The platform is hosted in professionally operated data centers whose providers maintain physical security controls, including restricted entry, surveillance, and environmental protections.
10. Logging & Monitoring
We record security-relevant events, including the following:
- authentication activity;
- privileged and administrative actions;
- configuration changes;
- application errors.
Each record includes enough context to investigate an incident. Logs are protected against unauthorized access and modification, and they are retained only as long as reasonably necessary. Availability, errors, and unusual activity are monitored so problems are found and dealt with promptly.
11. Backup, Recovery & Business Continuity
- Production databases and essential files are backed up at least daily.
- Backup copies are kept off the production server, in a separate location, so a single failure, compromise, or ransomware event cannot destroy both the data and its backups.
- Backups are verified for integrity, and restoration is tested periodically rather than assumed.
- Backups are retained for a defined period and protected with the same care as the production data they contain.
- We keep recovery procedures for our critical services, and we review them after significant changes and after incidents.
12. Vendors & Third-Party Services
- Before we rely on a service provider that will store or process Confidential or Restricted data, we review its security practices. We give each provider only the data and access it needs.
- Payment card data is handled by PCI DSS-compliant payment processors. VioletNexus does not store full payment card numbers.
- Optional integrations a Tenant chooses to enable, such as banking, calendar, email, or AI services, connect through the provider's official APIs with scoped, revocable access. Credentials for those connections are treated as Restricted information.
- Providers' security obligations are set out in our agreements with them, and their use is reviewed when services change.
13. Incident Response
We maintain an incident response process for suspected or confirmed security incidents. It covers:
- Report & triage: Personnel report suspected incidents immediately, and each report is assessed for severity and scope.
- Contain & eradicate: we limit the damage, preserve evidence, and remove the cause.
- Recover: we restore affected services and data from trusted sources and confirm normal operation.
- Notify: if an incident affects Tenant or personal data, we notify affected Tenants without undue delay and meet all applicable legal and contractual notification requirements.
- Learn: after each significant incident, we review its root cause and make improvements to prevent a recurrence.
14. Personnel Security & Awareness
- Before receiving access to Confidential or Restricted information, Personnel agree to confidentiality obligations.
- Personnel receive security awareness guidance when they join and periodically after that. It covers phishing, credential protection, and how to report concerns.
- Devices used to access VioletNexus systems must be kept up to date, protected with a screen lock and disk encryption where supported, and must never be left unattended while unlocked.
16. Reporting a Vulnerability
If you believe you have found a security vulnerability in VioletNexus, please email info@violetnexus.com with "Security report" in the subject line. Include enough detail for us to reproduce the issue. We will acknowledge your report, investigate, and keep you informed of our progress.
We ask that you:
- act in good faith;
- avoid accessing or changing other people's data;
- avoid degrading the service;
- give us reasonable time to fix the issue before disclosing it publicly.
We will not pursue legal action against researchers who follow these guidelines.
17. Compliance, Exceptions & Enforcement
- We comply with applicable data protection, privacy, and security laws, and with the security commitments in our agreements with Tenants.
- Any exception to this Policy must be justified, approved in writing by the Security Lead, time-limited, and covered by compensating controls where possible.
- Violations of this Policy may lead to loss of access and disciplinary action, up to and including termination of employment or contract, and legal action where appropriate.
18. Policy Review & Contact
We review this Policy at least annually, and also when our services, technology, or legal obligations change significantly. Any update is published on this page with a new version number and effective date.
Questions about this Policy, or requests for security information to support your own vendor review, can be sent to info@violetnexus.com.
| Version | Effective | Changes |
|---|---|---|
| 1.0 | October 19, 2026 | Initial publication. |