01
Workspace isolation
Records, configuration, files, connections, imports, automation state, and billing references carry a workspace boundary.
Trust needs evidence
Flexible on the surface. Firm at the boundaries.
Nesto is designed so customization does not weaken identity, workspace isolation, provider security, or data ownership. This page separates controls that exist from gates still required before broad production release.
External providers
Connected servicesSigned events
Nesto server boundary
Authorize · validate · queue
Workspace boundary
Records · files · history
Verified userSession and role
Default: deny
Truthful security status
Nesto does not claim a certification, regulated-industry suitability, or completed disaster-recovery program until the required evidence and agreements exist.
Do not trust the screen. Check the operation.
Hiding a button is useful interface design, not authorization. Protected work must earn access again on the server and inside the database boundary.
02
Permission at the operation
The server checks the signed-in person, workspace, role, module, and record access before protected work runs.
03
Credentials stay off the client
Provider secrets and privileged database access remain in server-only paths and are never returned with connection metadata.
04
Retry without duplication
Imports, provider sends, webhooks, and workflow work use durable state and idempotency where repeated delivery is possible.
One protected request
Every layer has one job.
A record update passes through identity, permission, payload, and database checks. The browser never receives the service credential that can cross those boundaries.
BrowserUser intent and visible state
SessionVerified identity
Server policyWorkspace, role, module, record
ValidationAllowed shape and bounded values
DatabaseRow-level security and atomic write
Data lifecycle
Access is only one part of responsibility.
Nesto also needs clear boundaries for storage, provider traffic, export, retention, and deletion.
Identify
Supabase Auth establishes the user session. Protected server work resolves the actor again before making a decision.
Authorize
Role and workspace checks combine with database row-level security instead of trusting a workspace ID from the browser.
Store
Primary CRM data remains in workspace-scoped Postgres tables. Attachments use private storage and short-lived signed access.
Verify providers
Incoming provider events must pass signature, size, replay, and workspace-routing checks before they can change state.
Export
Users can export records and a documented workspace archive. Hosted restore proof and queued delivery for exceptionally large workspaces remain release gates.
Delete
Workspace and account deletion are separate, reviewed operations that fail closed around billing, ownership, uploads, and cleanup.
Provider boundaries
Connected does not mean exposed.
The workspace interface can show account labels, health, scopes, and reconnect state. It does not need the underlying credential. When an integration vendor can hold and refresh a token safely, Nesto can keep only a provider-neutral connection reference.
- Least-privilege scopes
- Encrypted credential storage where Nesto must hold a key
- Signed callback and webhook verification
- Disconnect and deletion lifecycle
- No secrets in logs, records, screenshots, or AI prompts
AI boundary
AI proposes. Nesto still decides what is allowed.
Bounded context
Each feature receives only the data shape and amount required for that request.
Untrusted output
Generated structures and actions pass schema, permission, and business-rule validation.
Explicit destructive approval
High-impact AI suggestions cannot silently become destructive operations.
Spend ceilings
Workspace quotas and request limits keep optional AI work from becoming an open-ended charge.
Before general availability
Some controls need proof outside the codebase.
These remain explicit release gates. Nesto should stay in a controlled beta state until the deployed system, provider accounts, procedures, and policies pass them.
Run and document a successful backup restore against a non-production project
Verify production webhook signatures and failure paths with real sandbox events
Activate monitoring, alert routing, and a tested incident process
Complete counsel review of Terms, Privacy, retention, and subprocessor disclosures
Finish native-app privacy labels and Apple release review
Need to evaluate Nesto for a specific risk profile?
Read the current privacy noticeSecurity, retention, privacy, and regulated-data requirements should be reviewed against the exact deployed plan and vendor configuration.
Build trust deliberately
A CRM can be flexible without making its boundaries vague.
Nesto keeps identity, permissions, provider work, data ownership, and release evidence visible as the product grows.
Build your workspace