Compliance & Security

Ask Vendors to Show Their Security Controls in Action

If a vendor can't show a control live, assume it isn't working. Nexum's controls are on screen in a one-hour demo.

If a control can't be shown, assume it isn't working until proven otherwise.

Summary

Documents describe intentions; live demonstrations show reality.

A ten-step demo script verifies the most important controls in an hour.

Nexum can show nearly every step live, in the product.

Key takeaways

Run the ten-step script with every vendor.

Watch for controls that "can't be shown right now."

Run the script on Nexum in a demo.

Documents vs. demonstrations

Policies and certifications say what should happen. A live demo shows what does.

A one-hour security demo script

Ask the vendor (or your installer) to show:

1. Sign-in with multi-factor authentication. Including what happens when the code is wrong, and how enforcement is configured.

2. Least privilege. Sign in as a collector and try to reach admin settings. Sign in as a client and try to see another client's accounts. Both should fail.

3. Per-user access. Remove an app from a user and confirm it disappears from their menu.

4. Suspension. Suspend a user and confirm they can't sign in.

5. Sign-in history. Show recent sign-ins for a user.

6. Sensitive data display. Show how SSNs appear in search and account screens (masked except last four).

7. Secrets handling. Show where API keys for connected services are stored, and confirm individual modules don't display or store them.

8. Audit logs. Show who downloaded or shared a file, and the history of changes on an account.

9. Contact restrictions. Try to log a call on a cease-and-desist account (should be blocked with an explanation).

10. Deployment controls. Explain who has administrative access to the infrastructure, how it's granted and how it's logged.

Watch for

Controls that "exist but can't be shown right now."
Features that require custom work to enforce.
Logs that don't include who, what and when.

Use it yourself

Agencies can run the same script on their own deployment each year, and before client audits. It doubles as evidence.

Nexum passes live

Two-factor sign-in, roles with per-user App Access, suspension and reactivation, the last 100 sign-ins per user, SSNs as last four digits, the single encrypted Service Credentials vault with modules showing only status and a test button, the File Sharing activity log, client portal scoping and red-bar contact blocks. Infrastructure access is configured in your own AWS account. And Nexum's code isn't published for attackers to study.

The bottom line

See controls work before you trust them. Bring this script to a Nexum demo. See vendor security evidence.

See it working in your agency

Book a 30-minute guided Nexum demo built around your agency's real bottleneck, or call 502ZONE directly at (786) 524-4252. Nexum Open CRM is free: no license fee, no seat fees, no subscription. Add 502ZONE modules only when you want more recovery.

Bring us your most expensive collections problem.

Our guided 30-minute session focuses on your real workflow and the problem costing you the most.

Schedule a Demo