How we protect your data
NurYzo is built on a modern, cloud-native stack with security-by-default. This page summarises how your account and business data are protected. If you believe you have found a vulnerability, please report it responsibly to contact@nuryzo.com.
Encryption in transit
Every connection to nuryzo.com uses HTTPS with TLS 1.2+ and modern cipher suites. HSTS is enabled with a long max-age so browsers refuse insecure connections.
Authentication & sessions
- Passwords hashed with bcrypt (cost factor 12) — plaintext passwords never touch our database or logs.
- Session tokens are signed JWTs rotated on every login.
- Brute-force protection: 5 failed attempts triggers a 15-minute account lock.
- Password-reset links are single-use with a 30-minute TTL.
API hardening
- All API routes are rate-limited per IP and per user.
- CORS is locked to the production origin — no wildcard access.
- Every request body is validated with strict schemas before hitting the database.
Data storage
Your account, saved contacts, business plans and search history are stored in a managed MongoDB cluster with encryption at rest. Backups are taken daily. Third-party AI providers (Claude, NurYzo Search Engine) see only the prompts we send them — they do not receive your account identity.
Responsible disclosure
Security researchers are welcome. Please send findings to contact@nuryzo.com with reproduction steps and expected impact. We commit to a first response within 72 hours and will publicly credit valid reports.
