Organizational isolation
Each database query runs in the context of the organisation (Row Level Security). A foreign organisation will not read other people's data.
SECURITY AND GDPR
Security built into the system.
Permissions are checked by the server and database - the interface only shows them.
Roles and permissions
10 roles with permissions checked by the API, not just the interface.
Admin MFA
Admin login requires code from authenticator application (TOTP).
Encrypted keys
Przelewy24, Stripe and Fakturownia keys are encrypted with AES-256-GCM and never reach the browser or application.
Request Protection
CSRF, security headers, query limits and server-side data validation.
Full audit
Each significant change goes into the log with author, time and tracking ID.
Idempotency
Repeated sell or scan requests will not have double effect.
Backups
Daily database backup and proven recovery procedure.
COMPATIBILITY
What is ready and what still needs acceptance checks
Done in the system
- Privacy policy, terms, cookies policy and GDPR information
- Change log (audit) with export
- Consent of guardians when registering children
- No advertising trackers
Before production launch
- Data processing agreement with the facility operator
- Document verification by lawyer and accounting
- Impact assessment (DPIA), if required
- Accessibility audit and penetration test
We do not declare certificates that we do not have. Details: GDPR information and privacy policy.
NEXASPORT & OSIR
See how NexaSport will organize your facility.
Explore bookings, the ticket office, classes, the app and reports using your facilities as an example. No obligation.