Security & trust
You're trusting NERP with invoices, clients and the day-to-day of your business. This page explains plainly how we protect that, and where our limits are.
1. Your business's data stays in your business
Every record in NERP belongs to one workspace. The database itself enforces who can read it (row-level security), so a bug in one screen can't show one business another business's data. Teammates only see workspaces they've been invited to, and their role (owner, admin, member) decides what they can change.
2. We never see your card
Payments go through Paddle, our payment partner and merchant of record. Paddle collects your card and issues your receipts. NERP never receives or stores card numbers. Owners and admins can update the card, download invoices or cancel from Settings → Plan & billing, or by emailing hello@naaxtech.com.
3. Where your data lives
- Database & files: Supabase (PostgreSQL), hosted in the United States (AWS us-east-1). Encrypted in transit (TLS) and at rest.
- App hosting: Vercel.
- Connected accounts:when you connect Google, Trello or Shopify through Connecty, its access keys are kept in an encrypted vault. The Google keys Boopy holds are stored encrypted at rest and are not readable through the app's normal database access. Bloggy's Google keys are encrypted at rest and handed only to members of your business who have Bloggy switched on. Each key is used only for the feature you turned on. You can disconnect Connecty integrations, Bloggy's Google account and Boopy's Google Drive from their settings pages. To stop Boopy's Calendar sync, remove Boopy's access in your Google Account.
We don't currently offer hosting inside the Philippines. If your business needs that, tell us before you sign up.
4. Signing in
Passwords are handled by our authentication provider and are never stored in plain text. Before deleting an account, Settings asks for your password and a one-time code sent to your email.
5. You can leave with your data
You can export your records (for example Docmaker invoices and Boopy reports) as CSV, and delete your account from Settings at any time. See the Privacy Policy for what we keep and for how long, and the Cookie Policy for what your browser stores.
6. What we don't claim
- NERP is not SOC 2 or ISO 27001 certified. We'll say so here when that changes.
- Docmaker helps you prepare invoices and receipts. It is nota BIR-accredited Computerized Accounting System (CAS), and it doesn't replace your accountant's advice on what your business must issue.
7. Report a problem
Found a security issue, or think something's wrong with your account? Email hello@naaxtech.comwith “Security” in the subject. A person reads every report. Please don't test against other people's data.