NexcubatorBlog · 17 October 2026 · 14 min read
Your Data, Your Key: Business Data Security You Can Explain
This post explains how Nexcubator protects your organisation's data, how you get it back out, and how you share it safely. For the whole picture, read What Is Nexcubator?
Who can actually read your company's data? And if a former employee asked tomorrow for a copy of everything you hold about them, how long would it take you to answer?
Most business software answers with one word, "encrypted", and leaves out whose key, who can open it, and how you get your data back out. Business data security you cannot explain, use or check is only a promise.
The solution: your own encryption key, and your data back when you ask
- Your organisation has its own encryption key. Chat, Drive file and folder names, document content, meeting notes and the details of outside shares are sealed with a key that belongs to your organisation alone, and nobody can quietly switch it off.
- Recovery has no single point of failure. A recovery key is split into three printed shares kept apart; any two recover the keys, one alone reveals nothing.
- GDPR data requests are built in, answered within one month: exports, a copy of one person's data, erasure, a legal hold, or closing the organisation.
- Secure file sharing outside, protected by a password, an emailed code, or both, and you can revoke it. Every upload is checked for viruses first.
- Plain about the limits. It is not end-to-end encryption, and we explain below what that means.
About the visuals: there are no screenshots in this post. The diagrams are illustrations drawn to explain the ideas, not product screens, and Harbour Works, Northwind Bakery and the people in the story are invented.
Why "it's encrypted" is not business data security
For data protection in a small business, four questions matter more than the word itself.
Encryption is only as private as the key, and only as useful as your ability to get your data back.
| The question | The usual answer | What you actually need to know |
|---|---|---|
| Who holds the key? | "We use industry-standard encryption" | Whether your organisation has its own key, and what it seals |
| Can the supplier lose it, or destroy it? | Rarely answered | Who can switch it off, what happens if they try, and how it is recovered |
| How do we get our data out? | "Contact support" | A request you can make, a deadline, and who can download the result |
| How do we share with clients? | An email attachment | A link that opens nothing on its own, and that you can take back |
A week at Harbour Works: an illustrative case study
Harbour Works is an invented design agency. Nora Byrne, Liam Farrell and Emily Hart are invented people.
It is Wednesday, 15 October, and three requests land on Nora Byrne, who owns Harbour Works' Nexcubator organisation.
The accountants want the year's records for the annual audit. Liam Farrell, who left in the summer, wrote on 14 October asking for a copy of the data Harbour Works holds about him. And because a tribunal claim about his time there is pending, nothing of his may be deleted while it runs.
Nora opens Admin › Data requests and makes three requests, each with a reason that stays with it: an export of the organisation, a copy of Liam's data on the basis of his own access request, and a legal hold on his data. Nexcubator checks and approves each one. The hold shows as in place, and the export and Liam's copy are made into Harbour Works' own encrypted storage, where only its owners can download them. Each part is kept for a week, then deleted.
The same afternoon, Nora needs to send the Q4 proposal to Northwind Bakery. Emily Hart, who looks after Harbour Works' administration, set the rules months ago: every share outside needs a password and an emailed code, every page carries a watermark, no share lasts longer than 30 days, and documents may go only to Northwind Bakery's email domain.
Nora shares the proposal for seven days and tells her contact the password by phone. What arrives at Northwind is an email in Harbour Works' look with a link that opens nothing on its own. The page asks for the password, then for a code sent to the contact's own inbox, and only then shows the proposal, with the contact's email address across every page. A forwarded email gets nobody in.
Why there are other data security and file-sharing tools, and what they miss
There are good reasons people use each of them. A cloud app is quick to start and somebody else runs it. A file-sharing link is the easiest way to send a large file. A password-protected zip works with any email. A separate secure-share tool does one job well. What each misses is the part nobody has time to check:
- A typical cloud app says "encrypted", but rarely with whose key, and getting your data out often starts with a support ticket. Nexcubator seals what you write with your organisation's own key, and an export is a request your owners make in Admin › Data requests.
- A file-sharing link opens for whoever has it, often for as long as it exists. In Nexcubator a link alone opens nothing. By default a share asks for a fresh code sent to the recipient's own inbox, is view only, carries their email address as a watermark, and ends after seven days.
- A password-protected zip often has its password sent in the next email, and once it is sent it cannot be taken back. Nexcubator never emails a share's password, Revoke stops a share at once, and by default you are told each time it is opened.
- A separate secure-share tool is one more place your documents go, with its own rules and records. In Nexcubator sharing outside is part of Drive: Administration's minimums apply to every share, and every share, open and download is in Drive's activity log.
- Any of them, at upload: a file can often be opened the moment it arrives. In Nexcubator every upload is checked for viruses first, and nothing opens until it is clean.
These are the defaults, not settings somebody has to find. The rest of this post explains what sits underneath.
Concept 1: Your own encryption key for your organisation
The idea: what you write is sealed with a key that belongs to your organisation, not shared with anyone else's.
Every organisation in Nexcubator has its own data key, using AES-256-GCM encryption. Before it is stored, the key seals:
- Chat: message text, file names, conversation names and topics.
- Drive: file and folder names.
- Docs, Sheets and Slides: the content you write.
- Meeting notes.
- Shares outside your organisation: their details.
Genie, Nexcubator's assistant, keeps its memory under a separate key, again one per organisation. Anybody reading stored data directly, from a backup for example, sees only scrambled text. You can see it for yourself: every Chat conversation's Details says "Encrypted with your organisation's own key".
Files themselves get the same treatment. Each organisation's Drive has its own storage and its own key, and Nexcubator staff using the cloud console cannot open the files in it.
Your organisation's keys are themselves locked by a master key in AWS Key Management Service in the EU, in Ireland, with a copy in Frankfurt.
Nobody can quietly switch it off. Disabling or deleting keys is refused to everybody except one emergency role, which needs a second factor. Any attempt sets off an alarm, and a deletion would wait 30 days before it took effect.
Concept 2: Recovery without a single point of failure
The idea: a key that can be lost is a risk; a key that one person can recover alone is another.
A sealed system has to answer an uncomfortable question: what if the master key is ever lost? Nexcubator's answer is a recovery key split into three printed shares, kept apart. Any two of them together recover every organisation's keys. Any one alone reveals nothing.
Files sent in Chat are covered too: each one has a second copy sealed with your organisation's key, so it can be recovered if it is ever needed.
Concept 3: Every file is checked before anybody opens it
The idea: a file is not available to anyone until it has been checked.
Every upload, in Drive, Chat or a project task, is scanned for viruses before anybody can open or download it, the person who sent it included. A file with a virus says "Blocked" and is deleted; one that cannot be checked, such as an encrypted archive, is blocked as unsafe. Drive and Chat refuse programs, scripts and web pages outright, because they can run code. In Drive and Chat there are two locks: Nexcubator will not hand out a file that has not passed, and the storage itself will not release it.
Concept 4: GDPR data requests, built to help you meet your duties
The idea: anything beyond what each person can see for themselves goes through a request, with a reason, an approval and a record.
An organisation's owner asks in Admin › Data requests. Nexcubator checks and approves. What was asked for is made in your organisation's own storage, under its own key, and only your owners can download it. Each part is kept for seven days, and each download link works for one minute. Nexcubator answers within one month.
| Request | What it is for |
|---|---|
| Export the organisation | Your files, projects, records, open chat channels and the audit log, for portability or your own records |
| Export including private channels and direct messages | Only with a stated legal basis (legal process, the members' consent or a legal obligation) and its evidence; members are told unless the law forbids it |
| A copy of one person's data | Answering their right of access |
| Erase somebody who has left | Their right to erasure; nobody still in the organisation can be erased |
| Legal hold | Nothing of that person's expires or is erased until the hold is lifted; it reads nothing and shows nothing |
| Close the organisation | A final export, then everything deleted, with a certificate |
Nobody, an owner included, can read another person's private messages without a request on a legal basis. Every member can download a copy of their own chat at any time, and that copy holds only their own words.
Closing the organisation is the last request. Nexcubator makes a final export, and your owners have 30 days to download it. Then the organisation and everything in it is deleted, including Drive's storage and its key and the chat key, and every owner receives a certificate of deletion. Every step, from asking to deleting, is written in the audit log.
Concept 5: Secure file sharing outside your organisation
The idea: a link alone should never open anything, and you should be able to take it back.
When a client or supplier needs a document, you share it under People outside your organisation, and choose how it is protected:
- Code by email: a new six-digit code sent to their inbox each time they open it.
- Password: one you give them by phone or message; Nexcubator never emails it.
- Password + code: both, which is two factors.
Shares are view-only unless you allow downloading. You choose how long the share lasts, and can watermark every page with their email address, block printing and copying, lock it to the first browser that opens it, limit the number of opens, and be told each time it is opened. Revoke stops it from that moment. Ten wrong passwords lock the share.
Administrators set the minimums for everybody: the least protection allowed, whether every share is watermarked or download is never allowed, the longest a share may last, and which email domains may receive one. Sharers can add more protection, never less.
One honest note: blocking download and printing works in the browser, and nothing can stop somebody photographing a screen. That is what the watermark is for: it shows whose screen it was.
What it is not: the limits, stated plainly
- It is not end-to-end encryption. The service itself opens messages for the people in a conversation, so that search and notifications work. What we promise is narrower and checkable: through the product, only the people in a conversation can read it (administrators and owners who are not in it cannot), and stored data is sealed with your organisation's key.
- Who talks to whom, and when, is not sealed. Who is in a conversation, when messages were sent, reactions and counts are needed for the product to work, so they are stored as they are.
- Backups keep data for up to 35 days after deletion. When you delete something, or close your organisation, it can remain in backups until they age out. After a closure, what was sealed in those backups cannot be read, because the key has been destroyed.
The principle underneath: sealed, recoverable, and yours to ask for
- Your key, not ours to share. Your organisation's work is sealed with a key that belongs to it alone, and nobody can switch it off without an alarm and a 30-day wait.
- No single point of failure. Recovery needs two of three shares; one person cannot do it, and one lost share costs nothing.
- Every request has a reason and a record. Exports, copies, erasures and holds are asked for, approved and logged, and what is made is for your owners alone.
- Plain about the limits. We tell you what is sealed, what is not, and why.
You can read the full detail on the Security page and see how it fits the rest of Nexcubator in How it works.
Frequently asked questions
How do I know our business data is encrypted with our own key?
Every Chat conversation's Details says "Encrypted with your organisation's own key". Every organisation has its own data key, using AES-256-GCM. It seals chat messages and conversation names, Drive file and folder names, the content of Docs, Sheets and Slides, meeting notes and the details of outside shares. Each organisation's Drive also has its own storage and its own key.
Can Nexcubator staff read our data?
Not through the product, and staff using the cloud console cannot open your files. They can see whether your key exists and how it is protected, never the key. Exports are approved by Nexcubator but made for your owners alone.
Is Nexcubator end-to-end encrypted?
No. The service opens messages for the people in a conversation so that search and notifications work, and who talks to whom, and when, is not sealed. Stored content is sealed with your organisation's own key, and only the people in a conversation can read it.
How do I answer a GDPR data request, such as a subject access or erasure request?
An owner asks in Admin › Data requests for a copy of one person's data, or for the erasure of somebody who has left. Nexcubator approves it and answers within one month, and only your owners can download the copy.
What happens to our data if we leave?
Ask to close the organisation. You get a final data export and 30 days to download it; then everything is deleted, including the keys, and every owner receives a certificate of deletion. Backups age out within 35 days, unreadable without the destroyed key.
Related reading
- What Is Nexcubator?: the ideas behind Nexcubator and all its apps.
- Security: how Nexcubator keeps your organisation's work apart, sealed, checked and private.
- Meetings and team chat: conversations sealed with your organisation's key, and secure messages.
- Your Business Runs on Twelve Apps: why one place for your data is easier to protect than twelve.
Where it stands
Your organisation's own key, virus checking, data requests and secure sharing outside are part of Nexcubator and available in the beta now, for every organisation.
If you have ever been asked "who can read our data?" and not had a straight answer, this is the conversation we want to have.
Nexcubator is business software by Aitina Tech. Request early access and ask us anything about where your data lives.
Nexcubator is built on two Aitina Tech frameworks: Software as a Capability and OKL. The engineering practice behind posts like this one is AI harness engineering.
This is the product it came out of.
Nexcubator runs jobs, people, time and money in one place, hosted in the EU or in your preferred region. Free during early access.
Request early access More posts