1. Hosting and certificates
Every Nextcore product runs on Vercel in its Singapore region, with its database on Neon PostgreSQL in AWS ap-southeast-1 (Singapore). Your product data is stored in Singapore.
Vercel holds SOC 2 Type 2 and ISO/IEC 27001 certification. Neon holds SOC 2 Type II, ISO/IEC 27001:2022 and ISO/IEC 27701 certification. Both publish their reports on their own security pages.
Those certificates belong to our hosting providers. Nextcore itself does not hold a SOC 2 report or an ISO 27001 certificate. If your procurement process needs a security questionnaire answered, ask us and we will answer it in writing.
2. Encryption
- In transit: TLS on every connection to every product and to this website.
- At rest: AES-256, applied by Neon to every database.
- Field level: NextHR encrypts government ID numbers and bank details, and Next-EMR encrypts patient records, inside the application before they reach the database.
3. Controls by product
Products differ, so we list them separately. Every product scopes each query to your company.
| Product | Sign-in | Data protection | Audit trail |
|---|---|---|---|
| NextERP | Password | Row-level security in the database; maker-checker approvals; period locks | Hash-chained |
| NextHR | Password with TOTP; SAML single sign-on (Microsoft Entra ID) | AES-256-GCM encryption of government IDs and bank details, field by field | Hash-chained |
| LedgerOne | Password with optional TOTP | Company-scoped queries | Hash-chained |
| Next-EMR | Password with optional TOTP | Field-level encryption of patient records | Hash-chained |
| Nextpense | Password | Row-level security in the database; self-approval blocked | Enforced in the database |
| NextPOS | Password | Offline data encrypted on the device (SQLCipher) | Chained Z-readings |
A hash-chained audit trail links each entry to the one before it, so a changed or deleted entry breaks the chain and shows up when the trail is checked. QuickDesk, NextReserve and Nextbill keep standard activity records and are not listed above.
4. Service providers
These companies process data on our behalf. Each is bound by its own data protection terms.
| Provider | What it does for us | Where |
|---|---|---|
| Vercel | Hosting for every product and this website | Singapore region |
| Neon | PostgreSQL databases for every product | Singapore (AWS ap-southeast-1) |
| Microsoft Azure Communication Services | Transactional email: sign-in links, notifications, receipts | United States |
| PayMongo | Card payments in pesos | Philippines |
| Paddle | International subscription payments, as merchant of record | United Kingdom |
| Apple App Store and Google Play | In-app purchases in the mobile apps | United States |
| Anthropic | Receipt scanning in Nextbill | United States |
| Upstash | Rate limiting in Nextbill | United States company |
| Formspree | The contact form on this website | United States |
We do not sell your data, and we do not use it to train AI models.
5. Privacy
We handle personal information under the Philippine Data Privacy Act of 2012 (RA 10173). Our Privacy Policy and Data Privacy Act notice explain what we collect and the rights you have.
6. Report a vulnerability
If you find a security problem in a Nextcore product or this website, email sales@nextcoretechnology.com with "Security report" in the subject line. Tell us what you found and how to reproduce it. Please give us reasonable time to fix it before you disclose it, and do not access data that is not yours.
Our security.txt file carries the same contact details.