Security Overview

1.Our Approach

NEXTMRKT uses administrative, technical, and organizational safeguards designed to protect business accounts, marketplace information, and platform operations. Security is a shared responsibility: NEXTMRKT secures the Services, while customers must manage their users, credentials, devices, disclosures, and counterparty decisions.

2.Identity and Access

• User authentication and session management supported by Clerk.
• Role- and organization-based access controls intended to limit users to authorized company data and functions.
• Administrative controls for inviting, deactivating, and managing company users.
• Logging of account, administrative, and security-relevant actions. Sign-in events are logged by our authentication provider.

3.Data Protection

• Encryption in transit using current transport security practices.
• Controlled storage and access practices for application data and attachments.
• Separation of customer organizations through application access controls.
• Retention of transaction, audit, and security records when reasonably necessary for integrity, compliance, and incident response.
• Where we request a Form W-9 from a supplier, it carries a taxpayer identification number. The full number is never written to the NEXTMRKT database — it is masked at submission to its last four digits, and the submitted form is held in separate, access-restricted storage that a NEXTMRKT administrator reaches only through a short-lived link.

4.Application and Infrastructure Security

• Secure development and change-management practices appropriate to the stage and risk of the product.
• Dependency, vulnerability, error, and operational monitoring using internal controls and service-provider capabilities.
• Backups, resilience measures, and recovery practices designed around service requirements.
• Use of established infrastructure, authentication, payment, and communications providers with security responsibilities allocated by service.

5.Payments

Stripe processes payment information for paid subscriptions and seats. Card details are entered into Stripe directly and NEXTMRKT does not receive or store full payment card numbers — what reaches NEXTMRKT is transaction status, the billing contact, and payment method descriptors. Stripe's security, privacy, and compliance practices apply to information it processes directly.

6.Incident Response

If we identify a suspected security event, we will assess it, contain and remediate the issue, preserve relevant evidence, coordinate with affected providers, and notify affected parties or authorities when required by law. Response timing and content depend on the facts and applicable obligations.

7.Customer Responsibilities

• Use unique credentials and protect access to email and devices used for authentication.
• Grant users only the access needed for their roles and promptly deactivate departing personnel.
• Review RFQs, quotes, messages, and attachments before sharing sensitive information.
• Verify counterparties and use separate agreements for confidentiality, quality, payment, and transaction requirements.
• Report suspected unauthorized access or vulnerabilities promptly.

8.Assurance Statements

9.Reporting Security Concerns

Include a clear description, affected account or feature, reproduction information, and potential impact. Do not access other users' data, disrupt service, use social engineering, or publicly disclose an unresolved issue without coordinating with NEXTMRKT.