COMPANY / SECURITY
Security & trust.
The control layer must be inspectable.
Security posture should match the role of a system that sits before consequential autonomous actions.
Current web controls
- HTTPS with HSTS on the public website
- Restrictive browser security headers
- Server-side payment amount authority
- Signed payment webhook verification
- Secrets stored outside the public frontend
- Public API contracts and discovery for NexusEval
Payment boundary
Customer-specific commercial payments are created server-side after a quote is approved. Browser-supplied amounts are not treated as authoritative. Payment completion should be verified from the provider rather than inferred from a redirect alone.
Responsible claims
No evaluation layer can guarantee universal correctness, compliance or safety. Security and trust claims on this site are deliberately scoped to implemented controls and publicly inspectable interfaces.