NEXERA PXM runs on European infrastructure, designed and operated in the Netherlands. Strict tenant isolation at the database row level. Audited annually by CI-Audit. Governed by DEED. Used by serious retailers running serious catalogs.
Operating across the Netherlands, Germany, France and the UK on production catalogs
All product data, assets and AI logs live on European infrastructure. PostgreSQL clusters in EU-Central. Cloudflare R2 buckets pinned to EU regions. Never replicated outside the EU, ever, not for analytics, not for backups, not for support.
Multi-tenancy that isn't a polite suggestion. Every row in 109 database tables carries a tenant_id with a PostgreSQL Row-Level Security policy enforced at the database layer. The application layer can't bypass it, only a narrowly-scoped admin client can, and only for auth.
Passwordless OTP login. JWT access tokens expire in 15 minutes. Refresh tokens rotate; if an old one is reused, the entire family is revoked and the user is logged out everywhere. Tokens hashed with SHA-256, never stored in plaintext.
Every create, update, delete, role change, module toggle, plan change, import, export, sync, and impersonation event lands in the audit log. Filterable by user, action, date range. Exportable on demand. Kept for the lifetime of the tenant.
Shopify access tokens encrypted at rest. Webhook payloads verified by HMAC against per-store secrets. Claude calls go through a circuit breaker. Sentry catches errors with PII scrubbing. Health endpoints are public, detailed health is SUPER_ADMIN only.
Eight roles from SUPER_ADMIN down to VIEWER plus supplier-side roles. Module-gated features, tenants only see modules their plan enables. Permission matrix enforced at the API layer; SUPER_ADMIN impersonation always emits an audit event.
NEXERA PXM is operated from the Netherlands, on EU infrastructure. We do not replicate, mirror or back up customer data outside the European Union. Period. The team building it is in Herten; the auditor signing off is CI-Audit; the legal entity is DEED B.V.
NEXERA undergoes annual security audits with CI-Audit covering tenant isolation, authentication, key management and data residency. DEED Vision, the studio that designed and built NEXERA, governs the platform's roadmap, security posture and incident response.
Annual penetration test and code review against the OWASP Application Security Verification Standard. Findings tracked to closure in a public-to-customers register. Latest report available on request under NDA.
Designed, built and operated by DEED Vision, a Dutch studio based in Herten. The same team that ships features handles incident response. Roadmap and security posture governed by DEED leadership.
A signed-in user clicks "update product." Here is everything that happens before a single row gets written.
Operator and processor under EU 2016/679. Standard Contractual Clauses where needed; DEED is the data controller for marketing and processor for tenant content.
Privacy notice ↓Standard DPA covering processing purposes, sub-processors, retention, deletion, and the audit clause. Custom DPAs on Enterprise.
Download template ↓External penetration test and source-code review. Findings tracked in our customer-visible register. Latest letter from CI-Audit on request under NDA.
Request audit letter →Type II report covering Security, Availability and Confidentiality. Observation period started Q1 2026. Letter of intent available; full report mid-2026.
Roadmap status →ISMS scope drafted around platform engineering and operations. Internal audit complete; external certification scheduled for late 2026.
Roadmap status →Current sub-processors: Cloudflare (R2 + edge), Anthropic (Claude), Stripe (billing), Resend (email), Sentry (errors). Versioned and dated.
Subprocessor register →Material incidents are disclosed to affected tenants within 72 hours of confirmation. The same engineers who shipped the affected feature handle response. No offshore Tier-1 triage queue. No incident-management PR firm.
A redacted post-mortem is published to the customer-visible status site, with the underlying root cause, timeline, and the change shipped to prevent recurrence. Severe incidents trigger a written letter from DEED leadership.
Want the audit letter, the DPA template, the subprocessors list, or a chat with the operator about tenancy? Send a note, same team responds within a working day.