Security and trust
Trust and compliance at Nexapp
Company and product certifications, India-resident operations and post-quantum encryption, with the evidence your security and procurement teams ask for.
- ISO 27001
- Information security, 2022 edition
- India
- Management and logs, hosted or self-hosted
- FIPS 203/204
- Post-quantum on IKEv2 tunnels and TLS 1.3
- 75,000+
- Devices in production since 2014
Certifications
Independently certified, as a company and for our products
Company certifications
ISO/IEC 27001:2022
Information security management
How Nexapp protects information: risk assessment, access control, incident handling and continual improvement.
CertifiedRequestISO/IEC 20000-1:2018
IT service management
How services are designed, delivered and supported, including incident, change and service-level management.
CertifiedRequestISO 9001:2015
Quality management
Consistent processes for design, development and delivery, with measured customer satisfaction.
CertifiedRequestISO 14001:2015
Environmental management
How environmental impact is identified, controlled and reduced across operations.
CertifiedRequestGreat Place to Work-Certified™ 2026
Workplace culture
Company-wide certification by Great Place to Work® India.
CertifiedRequest
Product certifications
TEC MTCTE
Mandatory Testing and Certification of Telecom Equipment
Certificate 244903206, valid to March 2035. Covers Instaroute IR1100 4G routers, the 4G and 5G outdoor units and the IRX100-5G; not the IRX100-5Gv2 or IRX400 to IRX5000.
CertifiedRequestIEC 62443
Industrial automation and control system security
The international standard for securing industrial and OT networks. Scope and certificate on request.
CertifiedRequestCE
European conformity marking
Conformity with European health, safety and environmental requirements. Details per model on request.
CertifiedRequestRoHS
Restriction of Hazardous Substances
Limits on hazardous materials in electrical and electronic equipment. Details per model on request.
CertifiedRequest
Nexapp designs and engineers its routers and platform in India and is a Class-I local supplier under the PPP-MII Order. It supports bid teams with spec sheets, compliance statements and the local-content certificate for each tender.
Security practices
How we build, run and protect the platform
Secure product development
- Signed firmware and configuration. NexappOS firmware and configuration are signed with a post-quantum signature scheme, and every image is verified at upload, publish and dispatch; an unsigned image is refused and never sent to a router.
- Controlled change. Configuration snapshots, diff and rollback; a CLI preview before every push; canary firmware rollout with rollback.
- SBOM and CBOM. A cryptographic bill of materials (CBOM) is available, in line with CERT-In's July 2025 technical guidelines on SBOM, QBOM and CBOM.
- Vulnerability disclosure. Report security issues to [email protected].
- Product end-of-life policy. Coming soon.
Access and identity
- TACACS+ and RADIUS for administrator authentication.
- Passkey sign-in on Nexapp SSE.
- Multi-tenant separation across the MSP console and REST API.
- NexParth AI proposes changes and waits for human approval before acting, and every action is audited.
Network and platform resilience
- Device HA (VRRP), controller HA and DC–DR replication.
- Sub-second failover between links on SLA probes.
- 24×7 NOC in Pune with country-wide field operations and one SLA across hardware, firmware and platform.
Our own information security
- ISO/IEC 27001:2022 information security management system.
Data residency
Your data stays in India, or in your own data centre
Nexapp-hosted in India Self-hosted
- Nexapp-hosted in India. Controller, management and logs run on Nexapp's India-resident cloud; on Instaroute SDWAN Lite 2.0 each customer gets a dedicated subdomain and TLS certificate.
- Self-hosted. Nexapp Controller and Instaroute SDWAN Lite 2.0 ship as container stacks you can run on your own servers, VMs or private cloud, in your DC and DR, so your data never leaves your network.
- NexParth AI. Runs on an open-weight model on your own GPU host. Fleet data never leaves the deployment.
- Out-of-band management. Each router keeps an always-on, authenticated and encrypted management connection, separate from your business traffic, so it can be reached with no public IP and without a site visit.
Post-quantum cryptography
Post-quantum protection at every layer, generally available
- 1Key exchange
Hybrid classical + ML-KEM (NIST FIPS 203) on SD-WAN, router, SSE and management tunnels.
- 2Authentication
ML-DSA (NIST FIPS 204) certificates for IKEv2 and TLS peer authentication.
- 3Firmware integrity
Post-quantum-signed NexappOS firmware and configuration.
- 4TLS
Post-quantum TLS 1.3 (X25519MLKEM768) on consoles, APIs and SSE inspection.
- 5Crypto-agility and CBOM
Algorithms switchable by policy; a cryptographic bill of materials is available.
Indian regulations
How Nexapp helps you meet India's rules
| Regulation | Your obligation | How Nexapp helps |
|---|---|---|
| CERT-In Directions (28 April 2022) | Report cyber incidents within 6 hours; keep ICT logs for a rolling 180 days within India; sync clocks to NIC/NPL NTP servers | Centralised logs kept in India (Nexapp-hosted or self-hosted) with configurable retention; Instaroute SDWAN Lite 2.0 keeps alarm history for 180 days by default; alarms and 23 alarm metrics to speed detection; NTP servers configurable, so you can point devices and the controller at NIC/NPL time sources; a CBOM covering the minimum elements in CERT-In's Technical Guidelines (v2.0, 9 July 2025) |
| RBI Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions (31 July 2026) | Report incidents to RBI via DAKSH within 6 hours of detection; vulnerability assessment every 6 months and penetration tests every 12 months for critical systems; MFA for privileged users and for telework access to critical systems; strong, non-deprecated cryptography; secure configuration of network interconnections | VRF, zone firewall and SD-WAN segmentation; ZTNA with identity and device posture; IPS, gateway antivirus and web filtering; a CBOM that shows which algorithms are in use; logs and 25+ reports as audit evidence; India-hosted or self-hosted control for payment-data localisation. |
| DPDP Act 2023 and DPDP Rules 2025 | Substantive duties apply from about May 2027, including reasonable security safeguards (encryption, access control, logging and monitoring, logs kept at least one year) and breach reporting | Encryption in transit on every tunnel; identity-based access with ZTNA; DLP and CASB in Nexapp SSE; activity logs with configurable retention, which you can set to a year or more. Prepare now for May 2027 |
| SEBI CSCRF | Graded cyber controls for SEBI-regulated entities, in force for most from 31 August 2025, including SBOMs | Network security, logging and SOC integration as ongoing audit evidence; CBOM on request |
| TEC MTCTE and NCCS ComSec | Telecom equipment sold in India must carry MTCTE certification; IP routers and Wi-Fi CPE also need NCCS ComSec (ITSAR) security certification, mandatory since 1 July 2024 (ITSAR v2.0 since 1 April 2026) | TEC MTCTE certificate 244903206 (valid to March 2035) covers nine Instaroute router models. |
| DST quantum-safe roadmap (May 2026) | Non-binding national roadmap: critical-infrastructure milestones in Dec 2027, 2028 and 2029 and later milestones for other enterprises; buyers to request vendor CBOMs from FY 2026-27, and to make them mandatory in procurement from FY 2027-28 | Full PQC generally available on IKEv2 tunnels and TLS 1.3 sessions; crypto-agility by policy; CBOM available today |
RBI has also asked payment system providers to begin work on quantum-safe payment systems and has formed an expert committee (Q-Safe). This is a call to prepare, not a rule; Nexapp's post-quantum stack helps you start now.
Documents on request
Certificates, CBOM and security documentation for your vendor assessment or tender.
Request documents- Certificate pack (ISO, MTCTE, IEC 62443)
- CBOM sample and SBOM
- Security architecture whitepaper
- Post-quantum technical note
- RBI outsourcing contract pack
- Tender compliance annexure template
Frequently asked questions
Is Nexapp CERT-In certified?
CERT-In empanels security auditors; it does not certify products.
Nexapp provides the logging, log residency in India and time-sync controls that help you meet your CERT-In obligations, including 180-day log retention and 6-hour incident reporting.
Which Nexapp routers are TEC MTCTE certified?
TEC MTCTE certificate 244903206, valid to March 2035, covers Instaroute IR11004GS, IR11004GSW, IR11004GD, IR11004GDW, IR1180DM, IR1190DMG, IR1105-ODU-4G, IRX100-5G and IRX1160-ODU-5G.
It does not cover the IRX100-5Gv2 or the Enterprise X Series. You can check it on the public MTCTE portal.
Where is my data stored?
In India when Nexapp hosts the platform, or in your own data centre when you self-host.
NexParth AI runs on your own GPU host, and fleet data never leaves your deployment.
Does Nexapp help with the RBI Directions of 31 July 2026?
Yes. Centralised logging, MFA-based remote access, VRF and zone segmentation, and a CBOM support the Directions' requirements on 6-hour incident reporting, MFA, secure network interconnections and strong cryptography.
The obligations remain with the bank or regulated entity.
What does DPDP mean for our network, and when?
The DPDP Rules' substantive duties, including security safeguards and breach reporting, apply from about May 2027.
Nexapp helps you prepare with encryption on every connection, identity-based access and logs kept for a year or more. DPDP does not require all data to stay in India.
Is Nexapp's encryption quantum-safe?
Nexapp uses NIST-standard post-quantum algorithms: hybrid ML-KEM key exchange, ML-DSA authentication, post-quantum-signed firmware and post-quantum TLS 1.3.
India's post-quantum certification labs are not yet operating, so no vendor can yet hold an Indian quantum-safe certificate.
Do you provide an SBOM or CBOM?
A CBOM is available on request, in line with CERT-In's July 2025 guidelines and the DST roadmap.
How do I report a vulnerability?
Write to [email protected] with the details, and please do not disclose the issue publicly until we have fixed it.
Need certificates, a CBOM or a compliance annexure for your tender?
24×7 NOC in Pune · 75,000+ devices deployed · 400+ enterprise and banking customers since 2014.