↑

Trust & security at Nexus.

A cybersecurity firm's website should model good practice. Here's how this site protects you, how we handle information, and how to report a security issue.

Practicing what we advise

How this site protects you

Encrypted everywhereHTTPS only, with HTTP Strict Transport Security (HSTS).
No ads or social trackersNo advertising pixels and no social media widgets. Privacy-minded analytics only, described below.
Self-hosted fontsFonts are served from this site, so your visit isn't shared with a font provider.
Your data stays with youChecklist answers and the password checker stay in your browser. The intake is sent to us only when you choose “Send my request.”
Safe external linksOutbound links open with noopener noreferrer so other sites can't control this page or see where you came from.
Published security contactA security.txt file in the RFC 9116 format, published at the site root, tells researchers how to reach us.

This site is hosted on Zoho Sites. Like any host, Zoho processes technical data such as IP addresses and may use essential cookies to deliver and secure the site; see Zoho's privacy policy.

Privacy notice

What we collect and why

Last updated October 23, 2026

Information you choose to send us

When you email us or book a call, we receive what you provide, such as your name, work email, company, and details about your security needs. We use it only to respond, prepare for and deliver consulting services, and keep records required for business purposes.

Website analytics

We use PostHog, a product analytics service hosted in the United States, to understand which pages are useful and to improve the site. It records page views and general interactions such as clicks, along with technical data like browser type and approximate location derived from your IP address, and may set a first-party cookie or local storage identifier. We configure it so that what you type into the intake form, checklists, and the password checker is excluded. We do not use analytics data for advertising or sell it. You can block analytics with your browser's privacy settings or an ad blocker without affecting how the site works.

Tools that run in your browser

The interactive checklists and the intake save your progress in your browser's local storage on your device. We cannot see this data. You can clear it at any time with the “Reset” or “Clear my answers” buttons, or by clearing your browser's site data. Avoid entering sensitive details on shared computers.

Consultation requests

When you choose “Send my request” on our Get Started page, your answers are sent over an encrypted connection to our client management system, Zoho CRM, operated by Zoho under its privacy policy. We use them only to respond to you, schedule a call, and prepare for our conversation, and we keep them only as long as needed for that purpose and our business records. We do not publish a public booking calendar; after reviewing your request, we send you a private scheduling link.

Who we are and our legal basis

Nexus Security Advisors is responsible for the information described here; contact us at info@nexussecurityadvisors.com. We process the information you send so we can respond to your request and take steps you ask for before any engagement, based on your consent and our legitimate interest in answering business inquiries. You can withdraw consent at any time by emailing us.

Where your information is stored and for how long

Requests are stored in Zoho CRM in Zoho's United States data center. If you contact us from outside the United States, your information is transferred to the United States under Zoho's data-transfer safeguards. We keep inquiry records only as long as needed to respond, provide services, and meet business and legal record-keeping needs, and we delete them on request where the law allows.

What we don't do

  • We don't sell or rent personal information.
  • We don't use your information for advertising.
  • We don't knowingly collect information from children.

Your choices

You can ask to access, correct, or delete information you've sent us by emailing info@nexussecurityadvisors.com. Depending on where you live, laws such as the CCPA or GDPR may give you additional rights, including the right to object, to data portability, and to complain to your local data protection authority. We will honor applicable requests and will not discriminate against you for exercising them.

Confidentiality of client information

Client engagement information is treated as confidential and protected with access controls, encryption, and least privilege. We are happy to sign a mutual NDA before detailed discussions.

Vulnerability disclosure policy

Report a security issue

We welcome reports from security researchers and follow coordinated disclosure practices aligned with ISO/IEC 29147.

How to report

Email info@nexussecurityadvisors.com with the subject “Security report.” Please include the affected URL or system, steps to reproduce, potential impact, and how to contact you.

Scope

nexussecurityadvisors.com and its subdomains, and our email domain. Third-party services we use (such as our hosting and scheduling providers) should be reported to those providers directly.

Please do

  • Act in good faith and give us reasonable time to fix the issue before disclosure.
  • Interact only with your own data and use the minimum access needed to demonstrate the issue.
  • Stop and report as soon as you encounter any personal or client data.

Please don't

  • Run denial-of-service, spam, or automated high-volume scanning.
  • Use social engineering, phishing, or physical attacks.
  • Access, modify, or keep data that isn't yours.

Our commitment

We aim to acknowledge reports within three business days, keep you informed as we investigate, and credit you publicly if you'd like.

Safe harbor

If you make a good-faith effort to follow this policy, we consider your research authorized, we will not pursue or support legal action against you (including under the Computer Fraud and Abuse Act or anti-circumvention laws such as the DMCA), and if a third party takes legal action over research that followed this policy, we will make it known that you acted in compliance with it. If you're unsure whether something is in scope, ask us first.

Email security

Verifying it's really us

Our domain publishes SPF, DKIM, and a DMARC policy so receiving mail servers can reject messages that spoof us, plus TLS reporting to monitor encrypted delivery. Legitimate email from us comes only from addresses ending in @nexussecurityadvisors.com. We will never ask you to pay an invoice to new bank details by email alone. If something looks off, contact us at info@nexussecurityadvisors.com using an address you already know, not by replying to the suspicious message.

Accessibility

Built for everyone

We design this site to meet the Web Content Accessibility Guidelines (WCAG) 2.2 at Level AA, including keyboard navigation, visible focus, sufficient color contrast, and support for reduced-motion settings. If anything is hard to use, email info@nexussecurityadvisors.com and we'll fix it or provide the information another way.