Skip to content
Nexus Auditor
English
Get started

Menu

English
Get started

Frequently asked questions

9 questions

Do you connect to QuickBooks?

No. There is nothing to authorize in your client's QuickBooks. You export three standard QuickBooks Online reports (Sales by Product/Service Detail, Transaction List by Customer with shipping and billing addresses, and the customer contact list) or fill in our one-file template, and upload them.

Why does the address matter so much?

A sale generally belongs to the state where the customer receives it, usually the ship-to address; the billing address is only a fallback when no delivery address is known. QuickBooks Online reports can show a customer's default address, or a blank, instead of the ship-to typed on the invoice, so Nexus Auditor records where each sale's address came from and flags results where more than 10% of sales rest on default addresses. Addresses that cannot be placed in a state are listed so you can fix them.

Which taxes and places does it cover?

State sales and use tax: economic nexus for every state with a sales tax plus DC, physical nexus in the client's home state (recording other offices, employees and inventory is coming), and the Alaska Remote Seller Sales Tax Commission threshold for the local taxes of its member cities and boroughs. New Mexico's gross receipts tax and Hawaii's general excise tax are treated as those states' sales taxes. States where localities administer their own sales tax, such as Colorado's self-collecting home-rule cities, are marked but not evaluated. Five separate business taxes (Washington B&O, Ohio CAT, Texas franchise, Delaware and Oregon gross receipts) are listed as not evaluated, and income taxes are not covered.

How current is the law?

Each state's economic nexus rule shows its source and the date it was last checked; all were rechecked in September 2026. Changes are added as new versions with effective dates: sales are counted under the rules in force on their dates, the threshold in force on the measurement date decides, and a threshold met only under an earlier version is marked for review. Rules where sources disagree or are silent carry a lower confidence rating, which lowers the finding's confidence.

What does a finding show?

The status for the state; each test the state applies (sales, and transactions where it still counts them) against its threshold with the rule's comparator; every measurement window; what counted, including the state's sales basis, marketplace and resale treatment, and exempt or resale claims without a valid certificate; the rule versions applied with their sources; and the reasons behind the confidence level.

Is this a filed return or a legal opinion?

No. Nexus Auditor is decision support for your professional judgment. It does not register, file or remit anything, and its results are not legal advice.

Who can see a client's data?

Each firm has its own workspace, and firms are isolated from each other in the database. Everyone in a firm, including guests, can see its clients; roles decide who can change data, and only owners and admins can undo an import.

What files can we upload?

CSV, XLSX or XLS files up to 25 MB and 250,000 rows each. Files are stored when you upload them, but no sales are recorded until you review the check and confirm, and an owner or admin can undo a confirmed import.

What does it cost?

Early access is by invitation while we work with a small group of firms. Pricing will be published before general availability.

Open full FAQ page
Documentation
Browse documentation

Modules / AI and operations

Supabase self-hosted

Run the full Supabase stack (Postgres, Supavisor, Storage) on your own host.

Setup and configuration

Follow the official self-hosting guide: clone supabase/supabase, copy docker/.env.example to docker/.env, and change every secret — POSTGRES_PASSWORD, JWT_SECRET, ANON_KEY, SERVICE_ROLE_KEY (regenerate with your JWT secret), DASHBOARD_USERNAME/DASHBOARD_PASSWORD, SECRET_KEY_BASE, VAULT_ENC_KEY, and the PG_META_CRYPTO_KEY. Start with docker compose -f docker/docker-compose.yml up -d.

This kit uses Better Auth, not Supabase Auth — you do not need to configure GoTrue providers for the kit; keep the bundled auth service internal if nothing else uses it. Supabase here supplies Postgres (via Supavisor) and S3-compatible Storage only.

Supavisor exposes the session pooler on 5432 and transaction pooler on 6543. Usernames must be tenant-qualified on the pooler: postgres.<tenant-id> — the tenant id is your project ref configured in the pooler env (default pooler_tenant_id). Direct Postgres (port 5432 inside the network or the mapped port) works with plain postgres.

Expose only what you need: the Kong gateway (8000/8443) fronts Studio, PostgREST, Storage, and Auth; database ports should stay on a private network or behind a firewall — never publish 5432/6543 publicly. Put TLS in front of Kong via your own reverse proxy; the Postgres port speaks TLS only if you configure certificates in the container.

Studio is protected by DASHBOARD_USERNAME/DASHBOARD_PASSWORD at the Kong layer — change both before exposing 8000. Keep 4000 (Kong admin) firewalled.

DATABASE_URL=postgres://postgres.<tenant>:<password>@<host>:5432/postgres
# serverless functions: port 6543 adds ?pgbouncer=true (prepare is disabled automatically)
STORAGE_PROVIDER=s3
STORAGE_ENDPOINT=https://<host>:8000/storage/v1/s3
STORAGE_REGION=us-east-1  # required by the S3 protocol; self-hosted accepts any region value
STORAGE_FORCE_PATH_STYLE=true

Implementation workflow

Generate S3 credentials for self-hosted Storage in Studio → Storage → S3 connection settings (or seed them via the storage env in docker-compose); then set STORAGE_* in .env like the cloud guide. Run migrations with pnpm --filter @supastack/db db:migrate against the session pooler or direct Postgres — never the transaction pooler.

Run pnpm supabase:doctor -- --fix-rls after migrating: self-hosted PostgREST exposes public-schema tables to the anon/authenticated roles exactly like cloud, so the kit's tables must have RLS enabled and the API roles revoked. The doctor prints the exact ALTER/REVOKE statements and applies them in one transaction.

Upgrades: pull new images, pg_dump your database volume first, and re-run migrations. For backups, cron pg_dump against the direct Postgres port — the transaction pooler is unsuitable for dumps.

Verification and troubleshooting

Failure modes: 'prepared statement ... does not exist' → you are on :6543 without pgbouncer handling (the kit disables prepare there automatically — verify the URL). 'too many connections' → Supavisor pool exhausted; lower maxConnections or raise pool_size in the pooler env. 'Tenant or user not found' → the pooler username must be postgres.<tenant-id>. If Studio loads but API calls fail, check Kong is proxying /rest/v1 and /storage/v1 and that JWT keys match the regenerated JWT_SECRET.