I’m Brandon, co-founder and CTO of Nexvia, and I’m responsible for the security of what we build. When a business starts using one of our systems, it trusts us with sensitive things: its sales, its cash, its customers, its WhatsApp conversations, its schedule. It makes sense to want to know what we do with all of that.
In this article I explain it plainly, system by system. At the end there’s a list of questions you can use to evaluate any software provider, not just us.
1. Your data doesn’t mix with another company’s
Many businesses use the same system at the same time, but each one must see only its own data. It’s the first thing we take care of.
- Vendor ERP: every company has its own database. When someone logs in, the system identifies which company they belong to and works only with that company’s database. If a company is deactivated, its users are logged out.
- Gridio: it also has one database per business. The business each request works with comes from the user’s session, on the server, not from anything the browser sends.
- Agenvia: businesses share one database, but every query is automatically filtered by business. The server sets that filter on every new record, so nobody can “ask” for another business’s data by changing a value on the page.
2. Who gets in and what each person can do
The other big risk is someone getting in who shouldn’t, or someone on the inside seeing more than they should.
Passwords aren’t stored. It sounds odd, but it’s true: all three systems store a fingerprint of the password (a hash) that is enough to check you typed it right, but from which the original password can’t be recovered. Not even we can see it.
Password-guessing attempts get cut off. After a few failed attempts in a row, the system blocks access for a while. That way nobody can try password after password until one works.
Each person sees only what they need:
- In Vendor ERP, the owner decides which modules each employee can open, which price lists they can use and which cash registers they can access. A cashier can take payments without seeing costs or reports.
- In Gridio there are three roles: owner, supervisor and agent. An agent only sees the conversations assigned to them or the ones nobody has taken yet, and only the owner can turn automatic replies on or off.
- Sessions expire on their own: if someone leaves the computer open, sooner or later the system asks them to log in again.
3. Card payments: we don’t store your card or your customers’
When a customer pays, what reaches us is the result: whether the payment was approved, for what amount and which operation it belongs to. And we don’t accept it blindly:
- In Vendor ERP, Mercado Pago payment notifications are checked against their signature, to confirm they were sent by Mercado Pago and not by a third party.
- In Agenvia, a deposit is marked as paid only after the system asks Mercado Pago directly and checks that the payment belongs to that booking, is approved and matches the amount.
4. Official WhatsApp, with a person in charge
Plenty of WhatsApp tools work by “imitating” WhatsApp Web from a computer. They’re cheap, but they break Meta’s rules, and the risk is real: your number can get banned, with all your contacts inside.
Gridio uses Meta’s official WhatsApp API, and Nexvia is a Meta Tech Provider. Also:
- Every incoming message is verified. Meta signs every message it sends us, and Gridio rejects any message without the right signature. Nobody can inject fake messages pretending to be WhatsApp.
- Each business’s access keys are stored encrypted. When you connect your WhatsApp to Gridio, the key that enables it isn’t stored in the clear.
- We don’t keep copies of your photos, audio or documents. They’re fetched from Meta when someone opens them.
- The business stays in control. Automatic replies only answer when they’re switched on and nobody on the team has taken the conversation. Anyone can take over a chat at any time and hand it back later.
5. If something goes wrong: backups and a record of who did what
No system is immune to things going wrong: a human mistake, a deletion that shouldn’t have happened, a server failure. What matters is how much can be recovered and how quickly you can understand what happened.
In Vendor ERP we run automatic backups of every database and of the files customers upload:
On top of that, important operations leave a trail. Every cash and stock movement is recorded with the user who made it. Stock movements aren’t deleted: they’re voided, and the system keeps who voided them, when and why. Price list changes are audited too. If a number doesn’t add up, you can reconstruct what happened.
And one detail that matters a lot at the counter: the point of sale doesn’t record the same sale twice. If the internet drops in the middle of a payment and the sale is sent again, the system recognises it and doesn’t duplicate it.
6. How we work on the inside
Technical measures only work if the team works with discipline. These are the rules we follow:
- Nothing goes straight to productionEvery change goes through a branch, a review and a test environment before reaching customers.
- Always an encrypted connectionAll three systems only work over HTTPS: anyone arriving unencrypted is redirected to the secure version.
- Secrets don't go in the codePasswords, keys and ARCA certificates are kept outside the code. In Vendor ERP, error reports hide passwords, keys and card data.
- Continuous monitoringWe centralise logs and metrics from our services, including the result of every backup.
- Audits and tested fixesIn 2026 we ran an internal security audit. Every fix is tested by repeating the attack in an isolated environment, with no real data.
Questions to ask any software provider
If you’re evaluating a management system, a WhatsApp tool or an online booking app (ours or anyone else’s), these questions tell you a lot in a few minutes:
- Is my data separated from other customers'? How? "It's all in the cloud" isn't an answer.
- Do you store card data? The healthy answer is no: payments should be processed by a specialised company.
- How often do you back up, and where are the copies kept? If they're on the same server as the system, one failure takes both.
- Can I limit what each employee sees? A cashier doesn't need to see costs or reports.
- Is there a record of who did each operation? Without it, a cash or stock difference has no explanation.
- If it's a WhatsApp tool, does it use Meta's official API? If not, your number is at risk of being banned.
- Who do I tell if I find a security issue? A serious provider has an address for that and a person in charge.
Frequently asked questions
Is my data mixed with that of other companies using the same system? No. In Vendor ERP and Gridio every company has its own database. In Agenvia all businesses share one database, but every query is automatically filtered by business, and that filter is set by the server, never by the browser.
Do you store my card details or my customers’? No. Card payments are made on Mercado Pago’s page or on its card terminal. Our systems only receive the result: whether it was approved, for what amount and which operation it belongs to.
What happens if data is lost? In Vendor ERP we run automatic backups every day, check every copy and store them on a different server from production. We keep 14 daily, 8 weekly and 6 monthly copies.
Does Gridio use official WhatsApp? Yes. Gridio runs on Meta’s official WhatsApp API and Nexvia is a Meta Tech Provider. It doesn’t use programs that imitate WhatsApp Web, which are the ones that get numbers banned.
How do I report a security issue? Email security@nexviasolutions.net. Our security page explains what to include in the report and what happens next.
If you have questions about how your data is protected in any of our systems, get in touch and we’ll tell you what you need to know.