Terms of use

Terms of Service

Last Updated: Jun 25, 2024

Thank you for selecting the Services offered by NEXTBYTE ICT SOLUTIONS CO LTD (referred to as “NEXTBYTE”) and/or its subsidiaries and affiliates (referred to as "NEXTACCOUNTING", "we", "our", or "us"). Review these Terms of Service ("Agreement") thoroughly. This Agreement is a legal agreement between you and NEXTBYTE. By clicking “I Agree,” indicating acceptance electronically, or by installing, accessing, or using the Services, you agree to this Agreement. If you do not agree to this Agreement, then you may not use the Services.

Section A: General Terms

Agreement

This Agreement describes the terms governing your use of the Nextbyte Services. It includes by reference:

• NEXTBYTE’s Privacy Policy
• Additional terms and conditions, which may include those from third parties.
• Any terms provided separately to you for the Services, including product or program terms, ordering, activation, payment terms, data processing agreements, etc.

You must be at least 18 years of age to use our Services. By accessing or using our Services you agree that:

• You can form a binding contract with NEXTBYTE;
• You will comply with this Agreement and all applicable local, state, national, and international laws, rules, and regulations, including import and export regulations.

Your Rights to Use the Services

The Services are protected by copyright, trade secret, and other intellectual property laws. You are only granted the right to use the Services and only for the purposes described by NEXTBYTE. NEXTBYTE reserves all other rights in the Services. Until termination of this Agreement and as long as you meet any applicable payment obligations and comply with this Agreement, NEXTBYTE grants to you a personal, limited, nonexclusive, nontransferable right and license to use the Services.

You agree not to use, nor permit any third party to use, the Services in a manner that violates any applicable law, regulation, or this Agreement. You agree you will not:

• Provide access to or give any part of the Services to any third party.
• Reproduce, modify, copy, sell, trade, lease, rent, or resell the Services.
• Decompile, disassemble, or reverse engineer the Services.
• Make the Services available on any file-sharing or application hosting service.

Payment

For Services offered on a payment or subscription basis, the following terms apply, unless NEXTBYTE or its third-party affiliate notifies you otherwise in writing. This Agreement also incorporates by reference and includes program ordering and payment terms provided to you on the website for the Services:

• Payments will be billed to you in Tanzania Shillings (TZS), U.S. dollars, or other currencies which may be made available (plus any and all applicable taxes, including without limitation VAT), as shown in the product ordering and subscription terms, and your account will be debited when you subscribe and provide your payment information, unless stated otherwise in the program ordering or payment terms on the website for the Services.
• You must pay with a valid credit card acceptable to NEXTBYTE, a valid debit card acceptable to NEXTBYTE, payment through Nextpay (Payment gateway), or by another payment option NEXTBYTE provides to you in writing.
• If your payment and registration information is not accurate, current, and complete and you do not notify us promptly when such information changes, we may suspend or terminate your account and refuse any use of the Services.
• If you do not notify us of updates to your payment method (e.g., credit card expiration date), to avoid interruption of the Services, we may participate in programs supported by your card provider (e.g., updater services, recurring billing programs, etc.) to try to update your payment information, and you authorize us to continue billing your account with the updated information that we obtain.
• NEXTBYTE Services at the then-current rates, unless the Services subscription is cancelled or terminated under this Agreement.
• Additional cancellation or renewal terms may be provided to you on the website for the Services.
• Existing customers will maintain subscription rates for future subscriptions, provided that the package is not changed. Only increases in fees will be at a rate of up to 10% of the current subscription rate every 3 years of subscriptions. When pricing changes on our packages occur, they will be applicable to new customers.

Free Trial Use of Services

NEXTBYTE offers a free trial of services for a period of 7 days where you will get full access to all features of the package you have selected. Once the trial period ends, you will be required to complete payment for the subscription of the package you were enrolled in. Failure to make payment within one (1) month after the trial period ends or leaving the trial account dormant for more than 10 days without the intention to use the system gives Nextbyte the right to remove your account from the server unless there is an oral or written agreement to keep your account. The trial period can be extended through a direct request to Nextbyte.

Use with Your Mobile Device

Use of these Services may be available through a compatible mobile device and Internet access, and may require software. You agree that you are solely responsible for these requirements, including any applicable changes, updates, and fees, as well as the terms of your agreement with your mobile device and telecommunications provider.

NEXTBYTE makes no warranties or representations of any kind, express, statutory, or implied, as to:

• The availability of telecommunication services from your provider and access to the services at any time or from any location;
• Any loss, damage, or security intrusion of the telecommunication service; and
• Any disclosure of information to third parties or failure to transmit any data, communication, or settings connected with the services.

Data Processing and Privacy

(a) NEXTBYTE is the controller of the personal information it processes about you when you use the Services, and (b) You acknowledge that NEXTBYTE will process your personal information as described in our Privacy Statement when you use our Services.

Data Storage Limitation

Every user subscribed to the service will be allocated 2GB of storage to keep their data and files attached through the application. Once the allocated storage usage exceeds the allocated size, NEXTBYTE will prompt you to increase the size of your storage by increasing your subscription monthly fee according to the prices at that time.

Content and Use of the Services

Responsibility for Content and Use of the Services: Content includes any data, information, materials, text, graphics, images, music, software, audio, video, or works of authorship of any kind that are uploaded, transmitted, posted, generated, stored, or otherwise made available through the Services ("Content"), which will include without limitation any Content that account holders (including you) provide through your use of the Services. By making your Content available through your use of the Services, you grant NEXTBYTE the right to host and use your Content. Archive your Content frequently. You are responsible for any lost or unrecoverable Content. You must provide all required and appropriate warnings, information, and disclosures. NEXTBYTE is not responsible for any of your Content that you submit through the Services.

You agree not to use, nor permit any third party to use, the Services to upload, post, distribute, link to, publish, reproduce, engage in, promote, or transmit any of the following:

• Illegal, fraudulent, defamatory, obscene, pornographic, profane, threatening, abusive, hateful, harassing, offensive, inappropriate, or objectionable information or communications of any kind, including without limitation conduct that is excessively violent, incites or threatens violence, encourages "flaming" others, or incurs criminal or civil liability under any local, state, federal, or foreign law;
• Content that would impersonate someone else or falsely represent your identity or qualifications, or that may constitute a breach of any individual’s privacy; is illegally unfair or deceptive; or creates a safety or health risk to an individual or the public;
• Except as permitted by NEXTBYTE in writing, investment opportunities, solicitations, chain letters, pyramid schemes, other unsolicited commercial communication, or spamming or flooding;
• Viruses, Trojan horses, worms, or other disruptive or harmful software or data; and
• Any Content that you do not own or have the right to use without permission from the intellectual property rights owners thereof.

Restricted Use of the Services: You shall not, and shall not permit any users of the Services or any other party to, engage in, solicit, or promote any activity that is objectionable or may be illegal, violates the rights of others, is likely to cause notoriety, harm, or damage to the reputation of NEXTBYTE, or could subject NEXTBYTE to liability to third parties, including: (i) unauthorized access, monitoring, interference with, or use of the Services or third-party accounts, data, computers, systems, or networks; (ii) interference with others’ use of the Services or any system or network, including mail bombing, broadcast, or denial of service attacks; (iii) unauthorized collection or use of personal or confidential information, including phishing, pharming, spidering, and harvesting; (iv) viewing or other use of any Content that, in NEXTBYTE’s opinion, is prohibited under this Agreement; (v) any other activity that places NEXTBYTE in the position of fostering, or having potential or actual liability for, illegal activity in any jurisdiction; or (vi) attempting to probe, scan, penetrate, or test the vulnerability of a NEXTBYTE system or network or to breach NEXTBYTE’s security or authentication measures, whether by passive or intrusive techniques. NEXTBYTE reserves the right to not authorize and may terminate your use of the Services based on reasonable suspicion of your activities, business, products, or services that are objectionable or promote, support, or engage in any of the restricted uses described above.

Community Forums: The Services may include a community forum or other social features to exchange Content and information with other users of the Services and the public. NEXTBYTE does not support and is not responsible for the Content in these community forums. Please use respect when you interact with other users. Do not reveal information that you do not want to make public. Users may post hypertext links to content of third parties for which NEXTBYTE is not responsible.

NEXTBYTE May Freely Use Feedback You Provide: You agree that Nextbyte may use your feedback, suggestions, or ideas in any way, including in future modifications of the Services, other products or services, or advertising or marketing materials. You grant NEXTBYTE a perpetual, worldwide, fully transferable, sublicensable, non-revocable, fully paid-up, royalty-free license to use the feedback you provide to NEXTBYTE in any way.

NEXTBYTE May Monitor Content: NEXTBYTE may, but has no obligation to, monitor access to or use of the Services or Content or to review or edit any Content for the purpose of operating the Services, to ensure compliance with this Agreement, and to comply with applicable law or other legal requirements. We may disclose any information necessary to satisfy our legal obligations, protect NEXTBYTE or its customers, or operate the Services properly. NEXTBYTE, in its sole discretion, may refuse to post, remove, refuse to remove, or disable any Content, in whole or in part, that is alleged to be, or that we consider to be, unacceptable, undesirable, inappropriate, or in violation of this Agreement.

Additional Terms

• NEXTBYTE Gives Professional Advice: Unless specifically included with the Services, NEXTBYTE is not in the business of providing legal, financial, accounting, tax, health care, real estate, or other professional services or advice. Consult the services of a competent professional when you need this type of assistance.
• We May Tell You About Other NEXTBYTE Services: You may be offered other services, products, or promotions by NEXTBYTE Services. Additional terms and conditions and fees may apply. With some NEXTBYTE Services you may upload or enter data from your account(s) such as names, addresses, phone numbers, and purchases to the Internet.
• Communications: NEXTBYTE may be required by law to send you communications about the Services or third-party products. You agree that NEXTBYTE may send these communications to you via email or by posting them on our websites.
• You Will Manage Your Passwords and Accept Updates: You are responsible for securely managing your password(s) for the Services and contacting NEXTBYTE if you become aware of any unauthorized access to your account. The Services may periodically be updated with tools, utilities, improvements, third-party applications, or general updates to improve the Services. You agree to receive these updates.
• Telephone Numbers: You may provide us with your telephone number as part of your customer record or registration or via other methods. You understand and agree that NEXTBYTE may use your telephone number for "multi-factor authentication" ("MFA"), to confirm your identity and help protect the security of your account. Part of the MFA identity verification process may involve NEXTBYTE sending text messages containing security codes to your telephone number. You agree to receive these texts from NEXTBYTE containing security codes as part of the MFA process. In addition, you agree NEXTBYTE may send automated text messages and pre-recorded voice messages to the telephone number you provide for other limited purposes, including: providing you with important critical notices regarding your use of the Services, or fulfilling a request made by you through the Services.
• Dormant Accounts: If you have subscribed and your account becomes dormant without any intention of renewing your subscription, Nextbyte has the right to deactivate and remove your account without notice if your account has been dormant for more than three (3) months. If you have the intention to renew in the near future, you are required to request a temporary account suspension within three months from your expiration date.

Disclaimers

Your Use Of The Services, Software, And Content Is Entirely At Your Own Risk. Except As Described In This Agreement, The Services Are Provided "As Is." To The Maximum Extent Permitted By Applicable Law, NEXTBYTE, Its Affiliates, And Its Third-Party Providers, Licensors, Distributors, Or Suppliers (collectively, "Suppliers") Disclaim All Warranties, Express Or Implied, Including Any Warranty That The Services Are Fit For A Particular Purpose, Title, Merchantability, Data Loss, Non-interference With Or Non-infringement Of Any Intellectual Property Rights, Or The Accuracy, Reliability, Quality, Or Content In Or Linked To The Services. NEXTBYTE And Its Affiliates And Suppliers Do Not Warrant That The Services Are Secure, Free From Bugs, Viruses, Interruption, Errors, Theft, Or Destruction. If The Exclusions For Implied Warranties Do Not Apply To You, Any Implied Warranties Are Limited To 60 Days From The Date Of Purchase Or Delivery Of The Services, Whichever Is Sooner.

NEXTBYTE, Its Affiliates, And Suppliers Disclaim Any Representations Or Warranties That Your Use Of The Services Will Satisfy Or Ensure Compliance With Any Legal Obligations Or Laws Or Regulations.

Limitation on Liability

To The Maximum Extent Permitted By Applicable Law, The Entire Liability Of NEXTBYTE, Its Affiliates, And Suppliers For All Claims Relating To This Agreement Shall Be Limited To The Amount You Paid For The Services During The Twelve (12) Months Prior To Such Claim. Subject To Applicable Law, NEXTBYTE, Its Affiliates, And Suppliers Are Not Liable For Any Of The Following: (a) Indirect, Special, Incidental, Punitive, Or Consequential Damages; (b) Damages Relating To Failures Of Telecommunications, The Internet, Electronic Communications, Corruption, Security, Loss Or Theft Of Data, Viruses, Spyware, Loss Of Business, Revenue, Profits, Or Investment, Or Use Of Software Or Hardware That Does Not Meet NEXTBYTE System Requirements. The Above Limitations Apply Even If NEXTBYTE And Its Affiliates And Suppliers Have Been Advised Of The Possibility Of Such Damages. This Agreement Sets Forth The Entire Liability Of NEXTBYTE, Its Affiliates, And Your Exclusive Remedy With Respect To The Services And Its Use.

You agree to indemnify and hold NEXTBYTE and its Affiliates and Suppliers harmless from any and all claims, liability, and expenses, including reasonable attorneys' fees and costs, arising out of your use of the Services or breach of this Agreement (collectively referred to as "Claims"). NEXTBYTE reserves the right, in its sole discretion and at its own expense, to assume the exclusive defense and control of any Claims. You agree to reasonably cooperate as requested by NEXTBYTE in the defense of any Claims.

Copyright Policy

We reserve the right to change this Agreement at any time, and the changes will be effective when posted through the Services, on our website for the Services, or when we notify you by other means. We may also change or discontinue the Services, in whole or in part. Your continued use of the Services indicates your agreement to the changes.

NEXTBYTE may, in its sole discretion and without notice, restrict, deny, terminate this Agreement, or suspend the Services effective immediately, in whole or in part, for suspicion of fraud, security, illegal activity, or unauthorized access issues to protect the integrity of our Services or systems and comply with applicable NEXTBYTE policy, or if you fail to comply with this Agreement or if you no longer agree to receive electronic communications. Upon termination, you must immediately stop using the Services, and any outstanding payments will become due. Any termination of this Agreement shall not affect NEXTBYTE’s rights to any payments due. Sections 3 through 15 will survive and remain in effect even if the Agreement is terminated.

You acknowledge that the Services, including the mobile application, delivered by NEXTBYTE are subject to restrictions under applicable Tanzania export control laws, including Tanzania trade embargoes and sanctions and security requirements, and applicable country or local laws to the extent compatible with Tanzania laws. You agree that you will comply with these laws and regulations and will not export, re-export, import, or otherwise make available products and/or technical data in violation of these laws, directly or indirectly.

General

Any Dispute Or Claim Relating In Any Way To The Services Or This Agreement Will Be Resolved By Binding Arbitration, Rather Than In Court, Except That You May Assert Claims In Small Claims Court If Your Claims Qualify. The Arbitrator Shall Apply Tanzania Law to all other matters. Notwithstanding anything to the contrary, any party to the arbitration may at any time seek injunctions or other forms of equitable relief from any court of competent jurisdiction. We each agree that any and all disputes must be brought in the parties' individual capacity and not as a plaintiff or class member in any purported class or representative proceeding. By entering into this Agreement and agreeing to arbitration, you agree to waive a trial by jury. In addition, you agree to waive the right to participate in a class action or litigate on a class-wide basis. You agree that you have expressly and knowingly waived these rights.

To begin an arbitration proceeding, send a letter requesting arbitration to NEXTBYTE. Arbitration will be conducted by telephone, based on written submissions, or in person in the county where you live or at another mutually agreed location. The decision of the arbitrator shall be final and not appealable, and judgment on the arbitration award may be entered in any court having jurisdiction thereof. This Section 13 shall survive expiration, termination, or rescission of this Agreement.

This Agreement, including the Additional Terms, is the entire NEXTBYTE understanding, communication, and agreement, oral or written, regarding its subject matter. If any court of law having jurisdiction rules that any part of this Agreement is invalid, that section will be removed without affecting the remainder of the Agreement. The remaining terms will be valid and enforceable. You cannot assign or transfer ownership of this Agreement to anyone without the written approval of NEXTBYTE. However, NEXTBYTE may assign or transfer it without your consent to (a) an affiliate, or (b) a company acquiring NEXTBYTE. Any assignment in violation of this Section shall be void. If you want to request a transfer of this Agreement, contact NEXTBYTE via email at: info@nextbyteco.tz

Privacy Statement

Last Updated: 2026-08-21 12:18:25

Introduction and Overview

NEXTBYTE leverages technology responsibly to power prosperity around the world, and we believe that everyone has a right to privacy. At NEXTBYTE, we view privacy as a key part of the value that we deliver to our customers. NEXTBYTE’s Data Stewardship Principles were developed to describe NEXTBYTE’s values regarding the data our customers entrust to us.

The NEXTBYTE Platform and your Information

When we say “platform” we mean that when you choose to share data with us, or bring over information from third parties (like a bank or loan provider), we use that data together, not just within the individual offering(s) you’re using. This means your bookkeeping details from NextAccounting, Inventory System and HR System all live together.

The personal information we use in this centralized way is all the information that NEXTBYTE knows about you. It includes your credentials; your name and contact details; payment information; information about your activities, your interests and preferences; insights about your finances or your business; the content you place in our Platform; and information we have collected about you from third-party sources.

Organizational Account Information

Some NEXTBYTE interact with an organization (such as your employer). If you are granted access to an organization or household account (for example, a business's account in NextAccounting), the owner of the organization or a designated administrator may control and administer details of your account, for example, by deciding your access rights; making decisions about your personal information (such as details about your payroll); or requiring you to take certain actions (for example, use location tracking to clock in for a shift). If your access rights are amended by the owner or designated administrator, then you may lose access to the information that is in the control of the organization.

Your NEXTBYTE may be subject to the organization’s policies, which may be different from this Statement. We are not responsible for the privacy or security practices of other organizations, and you should consider both the organization's policies and whether you are comfortable enabling the organization with access to your information prior to connecting to their services.

Information We Collect

Information we receive from you

The personal information that we receive about you depends on the context of your interactions with NEXTBYTE, how you configure your account and the choices that you make, including your privacy settings. Personal information that you provide may also depend upon what services or experiences you use, your location and applicable law.

• Register an account: We collect information when you create an account, interact with the NEXTBYTE Platform or activate a subscription. Personal information may include your contact information (such as your name, address, phone number and email), profile photo, billing information (your payment information), usernames and credentials.
• Identification information: We collect information to verify your identity, including your name, email and phone number(s).
• Customer support, product research, training and feedback: We may collect personal information when you reach out to us for support, give us feedback, participate in optional surveys, product research or training and you choose to share.
• Social and community content: We receive content you post on our social media pages and our community pages.
• Device information: We may collect information about your device such as Internet Protocol (“IP”) addresses, log information, error messages, device type, and unique device identifiers. For example, we may collect IP addresses from you as part of our sign in and security features.
• Content: We may receive information about your business, your finances, expenses, invoices, financial statements, details of your financial transactions, payroll details, payment details, tax return details, details about your customers or vendors or employees, income and wage information, and/or investment information. This will be at your own discretion for applicable on some scenarios e.g. Business Loan Application, NEXTBYTE and third party e.g. Bank may need these information.
• Third-party service content: We receive information about you when you sign into a third-party service with your account or when you connect your account to a third-party service. For example, you may choose to connect your account with your bank accounts. To sync your financial account information, we must access your financial account information.
• Usage information: We may collect usage information such as the pages you viewed, the features you use, your browser type and details about any links with which you interact.
• Location information: Certain features in the NEXTBYTE Platform may collect your precise location information, device motion information, or both, if you grant permission to do so in your device settings. For example, if you use our time-tracking service.
• Expert advice: The NEXTBYTE Platform provides many opportunities for you to connect with live experts, including, for example, accountants or tax preparers. When you interact with these experts, we may receive information about the questions you ask, the details of your accounts and the guidance provided to you.
• Information stored locally: Some of our web-enabled desktop services and offerings synchronize with the information on your computer. In doing so, we may collect information such as device information, product usage, and error reports. We may also store personal information locally on your device.
• Testimonials: When you authorize us to post testimonials about our products and services on websites, we may include your name and other personal information in the testimonial. You will be given an opportunity to review and approve the testimonial before we post it. If you wish to update or delete your testimonial, you can contact us.

How We Use Personal Information

We collect and process personal information from you only where:

• We have your consent to do so;
• We need the personal information to perform a contract with you or provide a service to you;
• Provide you with the benefits of the NEXTBYTE Platform and operate our business;
• The processing is in our legitimate business interests in those jurisdictions where legitimate business interest is a legitimate basis for processing; or
• We need to comply with legal requirements, including applicable laws and regulations.

Personal information is used to operate our business for the following purposes that are required to originate and maintain our relationship with you, including but not limited to:

• Provide you with the NEXTBYTE Platform and create your account
• Improve our products and services
• Run and manage our business, including resolving billing and financial disputes
• Evaluate your eligibility for financial offers, products and services
• Provide features to you, such as your free credit reports and scores
• Connect you with experts and other users
• Communicate with you, such as sending you electronic notifications concerning your financial privacy
• Advertise and market our services and experiences
• Personalize your experience and tailor recommendations and offers presented to you, including through the development of insights about you and your needs
• Provide you with support and resolve disputes
• Conduct research, including by partnering with academic institutions
• Comply with our legal and regulatory requirements
• Protect the rights, property, safety or security of the NEXTBYTE Platform, our customers, employees or others and prevent fraudulent or illegal activity
• To exercise our rights in the course of judicial, administrative or arbitration proceedings
• To enforce, remedy or apply our Terms of Service or other agreements and/or
• For other purposes that are compatible with the disclosed purposes if and where this is permitted by applicable law.

Your Information Rights and Choices

Your Rights

At NEXTBYTE, we believe that you have rights to information that pertains to you, your household and/or your business. If another person has input or processed information in the NEXTBYTE Platform on behalf of you, your family or your business (and we are processing such information as an Information Controller), you may ask to receive a copy of your information, even if you do not have an account with us.

Verification

To help protect privacy and the security of your information, you may be asked to provide additional information to verify your identity and/or ownership rights prior to us exercising your data rights. If we are unable to verify your identity or ownership rights to the data, we may not be able to provide you with data rights until you are able to provide us with proper documents.

Information Retention

Unless you specifically ask us to delete your personal information, we retain your personal information as long as it is necessary to comply with our data retention requirements and provide you with services NEXTBYTE request a deletion, we may be required to maintain your information for as long as necessary to:

• comply with our legal or regulatory compliance needs (e.g. maintaining records of transactions you have made with us);
• to exercise, establish or defend legal claims; and/or
• to protect against fraudulent or abusive activity on our service.

This means we may keep different information for different periods. If your account is canceled because you’ve not used it in a long time, we may delete this information straight away.

There may be occasions where we are unable to fully delete, anonymize, or de-identify your information due to technical, legal, regulatory compliance or other operational reasons. Where this is the case, we will take reasonable measures to securely isolate your personal information from any further processing until such time as we are able to delete, anonymize, or de-identify it.

Security of Your Information

We use physical, technical and organizational safeguards designed to protect your information. If you have any concerns regarding the security of your data, we encourage you to check our Security policy.

Changes to Our Privacy Statements

From time to time we may change or update our Privacy Statement. We reserve the right to make changes or updates at any time. If we make material changes to the way we process your personal information, we will notify you by posting a notice in our platform or on a community post; by sending you a notification; or by other means consistent with applicable law.

You can see when this Privacy Statement was last updated by checking the “last updated” date displayed at the top of this Privacy Statement. Please review this Privacy Statement periodically to stay informed about how Nextbyte protects your privacy.

Security Policy

Last Updated: 2026-08-21 12:18:25

Introduction and Overview

Our security strategy involves the following components

Organizational Security

We employ strict policies and procedures encompassing the security, availability, processing, integrity, and confidentiality of customer data.

Employee background checks: Each employee undergoes a process of background verification. We do this to verify their criminal records, previous employment records if any, and educational background. Until this check is performed, the employee is not assigned tasks that may pose risks to users.

Security Awareness: Each employee, when inducted, signs a confidentiality agreement and acceptable use policy, after which they undergo training in information security, privacy, and compliance.

We educate our employees continually on information security, privacy, and compliance in our internal community where our employees check in regularly, to keep them updated regarding the security practices of the organization. We also host internal events to raise awareness and drive innovation in security and privacy.

Dedicated Security and privacy teams: We have dedicated security and privacy teams that implement and manage our security and privacy programs. They engineer and maintain our defense systems, develop review processes for security, and constantly monitor our networks to detect suspicious activity. They provide domain-specific consulting services and guidance to our engineering teams.

Data Security

Data Isolation: Our framework distributes and maintains the cloud space for our customers. Each customer's service data is logically separated from other customers' data using a set of secure protocols in the framework. This ensures that no customer's service data becomes accessible to another customer.

The service data is stored on our cloud servers (Situated in Europe) when you use our services. Your data is owned by you, and not by NEXTBYTE. We do not share this data with any third-party without your consent.

Secure by design: Every change and new feature is governed by a change management policy to ensure all application changes are authorised before implementation into production. Our Software Development Life Cycle (SDLC) mandates adherence to secure coding guidelines, as well as screening of code changes for potential security issues with our code analyser tools, vulnerability scanners, and manual review processes.

Our robust security framework based on OWASP standards, implemented in the application layer, provides functionalities to mitigate threats such as SQL injection, Cross site scripting and application layer DOS attacks.

Encryption:

• In transit: All customer data transmitted to our servers over public networks is protected using strong encryption protocols. We mandate all connections to our servers use Secure Sockets Layer (SSL) encryption with strong ciphers, for all connections including web access, API access, and IMAP/POP/SMTP email client access. This method is used for keeping an internet connection secure and safeguarding any sensitive data that is being sent between two systems, preventing intruders from reading and modifying any information transferred, including potential personal details. The two systems can be a server and client or server to server.

Identity and Access Control

Authentication: Every user need to provide username and password (Login credentials) for authentication to login into the system. This add security layer to prevent access from unauthorized intruders. Authentication has been extended to API for all the integrations implement with other third parties partners.

Multi-Factor Authentication: NEXTBYTE platforms support multi-factor authentication which provides an extra layer of security by demanding an additional verification that user must possess, in addition to the password. This can greatly reduce the risk of unauthorized access if a user’s password is compromised. You can easily configure multi-factor authentication on the setting of our app. Currently, OTP (One time password) via email and sms are supported.

Administrative Access: We employ technical access controls and internal policies to prohibit employees from arbitrarily accessing user data. We adhere to the principles of least privilege and role-based permissions to minimize the risk of data exposure.

Access to production environments is maintained by a central directory and authenticated using a combination of strong passwords, two-factor authentication, and passphrase-protected SSH keys. Furthermore, we facilitate such access through a separate network with stricter rules and hardened devices. Additionally, we log all the operations and audit them periodically.

Operational Security

Backup: We run full backups everyday of our clients’ database and files. Backup data are stored on production server then transferred into the backup server which is on other data center. All backed up data are retained for period of 7 days. If client requests for data recovery within the retention period, we will restore their data and provide secure access to it. The timeline for data restoration depends on the size of the data and the complexity involved.

To ensure the safety of the backed-up data, we use a redundant array of independent disks (RAID) in the backup servers. All backups are scheduled and tracked regularly. In case of a failure, a re-run is initiated and is fixed immediately.

From your end, we strongly recommend scheduling regular backups of your data by exporting them from the respective NEXTBYTE services and storing it locally in your infrastructure.

Customer controls for security

Here are the things that you as a customer can do to ensure security from your end:

• Use multi-factor authentication.
• Choose a unique, strong password and protect it.
• Use the latest browser versions, mobile OS and updated mobile applications to ensure they are patched against vulnerabilities and to use latest security features.
• Exercise reasonable precautions while sharing data from our cloud environment.
• Monitor devices linked to your account, active web sessions, and third-party access to spot anomalies in activities on your account, and manage roles and privileges to your account.
• Be aware of phishing and malware threats by looking out for unfamiliar emails, websites, and links that may exploit your NEXTBYTE you trust.

Conclusion

Security of your data is your right and a never-ending mission of NEXTBYTE. We will continue to work hard to keep your data secure, like we always have.