Security

ConX runs entirely on Google Cloud (Firebase)— hosting, database, file storage, authentication and server functions. The infrastructure inherits Google Cloud's certifications, including ISO 27001 and SOC 1/2/3, and its physical data-centre security.

All traffic is encrypted in transit (TLS) and all stored data is encrypted at rest by default on Google Cloud.

Access is enforced at the database layer with Firebase security rules, not just in the apps:

— Your personal data (cards, connections, followed companies) is readable only by you.
— A company's leads, notes and tags are readable only by that company's members, checked against a server-side membership record on every request.
— Resumes are never public: the file has no public link, a company can open it only through our servers, only with an access grant created when you exchanged with them, and the grant expires automatically after the advertised share window.
— When a team member is removed, their work card is destroyed server-side, ending their ability to capture for that company.

Payments are processed by Stripe(PCI DSS Level 1). Card details are entered on Stripe's own pages and never touch ConX servers— we hold only your subscription status. Subscription changes are accepted only from Stripe's cryptographically signed webhooks.

Secrets (API keys) live in Google Secret Manager, never in the apps or the code repository. Administrative access to production is limited to the founding team on least-privilege terms. Firestore data benefits from Google Cloud's durability and point-in-time recovery capabilities.

ConX is an early-stage Australian company. We handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (see our Privacy Policy). ConX has not yet undergone its own independent SOC 2 audit — our infrastructure providers hold those certifications, and an independent audit is on our roadmap as the company grows. If your organisation has a security questionnaire, send it over — we answer them plainly.

Found something? Tell us at conx.connect@gmail.com with enough detail to reproduce it, and give us a reasonable window to fix it before public disclosure. We'll acknowledge within 72 hours, keep you updated, and credit you if you'd like.