You are trusted with your clients’ machines. We take that seriously.

Who can sign in

The most important control is who gets in. These are the controls on that door.

• Two-step sign-in with an authenticator app, plus single-use recovery codes if a phone is lost.
• Administrators can require two-step sign-in for everyone in the company, and reset it for a colleague who has locked themselves out.
• Repeated wrong codes lock the account for a period, and a code that has been used cannot be used again.
• Passwords are stored as salted bcrypt hashes, never in a readable form, and sign-in attempts are rate limited.
• Roles (administrator, technician and read-only) limit what each person can see and change.

Keeping companies apart

Many MSPs share the platform. Their data must never mix.

• Every company has its own workspace at its own address.
• Separation between companies is enforced in the database itself, not only in the application, so a mistake in one place cannot expose another company’s records.
• Platform staff access to a workspace for support is a deliberate action and is logged.

Talking to devices

The agent on each device is powerful, so the channel to it has to be trustworthy.

• Devices connect out to NexusRMM. There are no inbound ports to open on your clients’ networks.
• Each command sent to a device is individually encrypted and authenticated with a key that belongs to that device, so one device’s traffic is useless for any other.
• Agent updates are checked against a checksum before they are applied.
• Risky automatic changes are avoided: the Security screen will not change antivirus or password settings remotely.

Seeing what happened

When something goes wrong, you need the record.

• An audit log records what your team did in the platform, and who did it.
• Remote sessions on devices are logged.
• Every patch install and every security fix keeps its own history, with the output from the device.

Where it runs

• Hosted on servers in the UK.
• All access to the portal and the API is over HTTPS, with certificates managed automatically.
• Nightly backups of the platform database.

What is still ahead

We would rather be straight with you than overclaim. NexusRMM is not currently certified under a formal scheme such as ISO 27001 or SOC 2. Its security checks help you evidence device-level controls of the kind Cyber Essentials asks about, but they are not a certification. If your own clients or insurers require a particular attestation, ask us before you commit.