SECURITY & TRUST
Trust starts with being specific.
Nebijane builds software for real operational work. Security and responsible data handling are part of that responsibility.
This page describes the current security-related practices we can verify for the public Nebijane marketing website and the separate affiliate program area hosted on it. We prefer specific, supportable statements over broad claims that cannot be demonstrated.
Product-specific security information for ShiftSideKick, RouteSideKick, or future Nebijane software should be documented separately as those products move through their own security reviews.
Effective date: October 4, 2026
Secure application foundations
The Nebijane website is built on Laravel and uses standard application-layer protections appropriate to its current public surface.
Current protections include:
server-side validation for submitted form data;
CSRF protection on the Contact form;
escaped output in public website templates;
environment-based configuration for sensitive application settings; and
automated feature tests covering core website behavior and Contact-form protections.
The public marketing pages do not include customer account registration, customer login, or a customer portal. The separate affiliate program area described below has its own application, sign-in, and password-reset pages.
Affiliate program area
Separately from the public marketing pages, the Nebijane website hosts an affiliate program application and account area. It includes an application form, affiliate sign-in, password reset, email verification, an authenticated affiliate dashboard, and administrative pages used by Nebijane to review applications.
These accounts are for affiliate program applicants and participants only. They are not ShiftSideKick customer accounts, which are provided through the ShiftSideKick product.
Current protections in this area include:
- CSRF protection and server-side validation on affiliate forms;
- passwords stored in hashed form;
- rate limiting on application submissions, sign-in attempts, password-reset requests, and verification-email requests;
- email verification before the affiliate dashboard is available;
- administrative pages restricted to verified Nebijane administrator accounts; and
- page markings that ask search engines not to index application and account pages.
The affiliate program is not yet open for public promotion. When affiliate referral links are used, referral-click records store keyed hashes of IP address and user-agent rather than the raw values. More detail is in the Nebijane Privacy Policy and the Affiliate Program Terms.
Contact-form protection
The Contact form is the primary place where visitors can submit personal information directly to Nebijane.
The current form includes several safeguards:
- CSRF protection;
- server-side field validation;
- a controlled allowlist for inquiry reasons;
- rate limiting by IP address;
- an anti-spam honeypot;
- safe handling of submitted Reply-To information; and
- failure logging that does not intentionally record the full submitted message body.
Contact submissions are delivered through the configured email flow rather than being written to a dedicated Contact-submissions database table in the Nebijane application.
Limited data collection
The current Nebijane marketing website is intentionally limited in scope.
Apart from the affiliate program area described above, the site does not provide:
ShiftSideKick or other product customer accounts;
customer dashboards;
payment checkout;
file uploads; or
multi-tenant product data storage.
The website may use ordinary application sessions and supporting framework storage needed to operate the site.
For more detail about the information the website handles, see the Nebijane Privacy Policy.
Payments and payment processors
The Nebijane marketing website does not itself process ShiftSideKick subscription checkout or store payment-card information.
Nebijane uses third-party payment processors such as Stripe for paid ShiftSideKick subscriptions. Payment-card information may be collected and processed by Stripe depending on the checkout flow. Nebijane does not intend to store complete payment-card numbers when Stripe-hosted payment handling is used.
Billing rules are described in the Billing, Cancellation & Refund Policy. Product privacy details are in the ShiftSideKick Privacy Notice.
Development and testing
Nebijane uses version-controlled application dependencies and automated application tests as part of the website development process.
The current test suite includes feature coverage for website routes, Contact-form protections such as validation, CSRF handling, rate limiting, honeypot behavior, and safe error presentation, and affiliate application and account flows.
Security work is an ongoing engineering responsibility. As Nebijane’s websites and products evolve, security practices, testing, operational controls, and documentation may evolve with them.
We do not treat routine application testing as a substitute for independent security certification or penetration testing.
Clear about what has been verified
We believe trust is stronger when security claims match what has actually been reviewed.
This page therefore does not make claims about controls that have not yet been independently or operationally verified for the current Nebijane website, such as formal security certifications, continuous security monitoring, penetration testing, hosting-level backup guarantees, or universal encryption claims.
Likewise, this page does not make security claims for ShiftSideKick or RouteSideKick based solely on the Nebijane marketing website. Product-specific claims should be based on separate verification of those products.
Security and privacy
Security and privacy overlap, but they are not the same thing.
The Nebijane Privacy Policy explains what information the current website collects, how that information is used, and what is currently known about retention and service providers.
The Accessibility Statement explains the accessibility-conscious practices used on the current marketing website.
Privacy Policy
What information the current website collects, how that information is used, and what is currently known about retention and service providers.
AccessibilityAccessibility Statement
The accessibility-conscious practices used on the current marketing website.
Security & Trust
The current security-related practices we can verify for the public Nebijane marketing website.
Report a security concern
If you believe you have found a security issue involving the Nebijane website, please contact us through the Nebijane Contact page.
Choose Privacy or legal or General question and describe the issue.
Helpful information can include:
- the page or feature involved;
- what you observed;
- steps that reproduce the issue; and
- any other details that would help us understand the concern.
Please do not include passwords, complete payment-card information, or other highly sensitive information in the Contact form.
A dedicated security contact address may be published later once that mailbox is active, monitored, and approved for public use.
Contact NebijaneChanges to this page
We may update this Security & Trust page as the website, products, infrastructure, and security practices evolve.
When material changes are made, we will update the effective date shown on the page.