Separate systems
The public marketing website and individual NextCog applications are deployed as separate systems with different responsibilities.
Security approach
Keep the public surface small and the system boundaries clear.
NextCog treats security as an ongoing engineering responsibility. This page explains the approach without claiming certifications or guarantees that have not been established.
Static public architecture
The marketing website is delivered as static files. It has no public database, login flow, or server-side application runtime.
HTTPS
Production services should be served only over HTTPS, with HTTP redirected to the secure origin.
Dependency maintenance
Dependencies should be reviewed and updated as part of normal maintenance, with quality and build checks run before deployment.
Secure configuration
Application secrets and environment-specific configuration must remain outside the public website source and generated static files.
Environment separation
Development, review, and production environments should be separated to reduce accidental exposure and unintended changes.
Controlled data access
Access to application data should be limited to the people and services that require it for an authorized purpose.
Logging and monitoring
Application services should maintain appropriate operational logs and monitoring without placing sensitive details on this public site.
Responsible reporting
Found a security issue?
Please report a suspected vulnerability privately and include the affected URL, a clear description, and safe reproduction steps where possible. Do not access data that does not belong to you or disrupt service availability.