Security

In Transit: All data transmitted between your browser and Nesta Market is encrypted using TLS 1.3. We enforce HTTPS on all connections with HSTS headers.

At Rest: Sensitive credentials — payment gateway keys, store integration tokens and platform secrets — are encrypted at rest with authenticated symmetric encryption.

Custom Domains: Point your own domain at your store, verified with a DNS record.

JWT Authentication: Secure, token-based authentication with automatic expiration and refresh rotation.

Role-Based Access Control: Three access tiers per store — Owner, Admin and Staff — gate access to dashboard features.

Unified Auth: Single sign-on across the Wade Technology ecosystem with centralized session management.

Tenant Isolation: Every store's data carries a tenant ID, and the application resolves which store a request belongs to and scopes every query to it. That check is real and it runs on every read and write — but it is a single control in the application, not two. PostgreSQL row-level security policies are also defined on core tables; the database account the application connects with can bypass them, so we do not count them as a second line of defence.

Payment Security: We never store credit card numbers. All payment processing is handled by PCI-compliant providers (PayPal). Only tokenized references are stored.

Backups: Every production database is backed up automatically once a day, and each backup is copied off the server so it survives the loss of the machine itself. We rehearse restores on a schedule — into a clean, empty database, with row counts checked against the source — rather than assuming a backup would work. Recovery point is up to 24 hours: we do not currently offer point-in-time recovery, and backups are retained within a single region.

Hosting: Nesta Market runs on enterprise-grade infrastructure with DDoS protection and 24/7 monitoring.

Network Security: Cloudflare WAF (Web Application Firewall) protects against common attack vectors including SQL injection, XSS, and CSRF.