Frequently asked questions

General

What is Gerege Nexus?

A modular platform that runs an organisation's operations in one place. Contacts, products, inventory, billing and payments, file storage, documents, e-signature, general ledger, government services, the developer console and Office (real Word and Excel) — eleven modules on one core, one permission model and one database.

Who is it for?

Any organisation, public or private. No invitation is needed to register.

Does it cost anything?

Registration is free. One account may create up to two workspaces; beyond that, get in touch.

Which languages does it work in?

Seven: Mongolian (primary), English, Russian, Chinese, French, Spanish and Arabic — that is Mongolian plus the six official languages of the United Nations. Mongolian is not a translation here; it is the source.

Workspaces and data

What is a workspace?

One organisation is one workspace. Its data, members, roles and installed modules are all its own. A person works across several organisations with one account, switching between them from the chooser.

How is my data separated from another organisation's?

Physically, not by a filter. Every organisation's business tables live inside a PostgreSQL schema of their own, and each connection takes its path from the organisation the request belongs to. So reading another organisation's row by accident is not a matter of a forgotten WHERE clause — that table is not there for that connection.

Can I export my data?

Yes. Every business row in a workspace can be exported as a single JSON file.

Do I choose which modules to install?

Yes. Install what you need from the app store and close what you do not. The routes of an app that is not installed are closed — turning a module off is not hiding a menu entry, it is locking the door.

Signing in and identity

Four channels: a Google account, e-mail, a phone number (SMS code), or E-ID. Start with whichever you have.

What does "100% account" mean?

An account that has proved all three: e-mail, phone and E-ID. One of the three is 33%, two is 67%. It is not a gate — it is a statement of what has been proved.

Is E-ID actually live?

Yes. E-ID sign-in and qualified electronic signatures run live in production. DAN, XYP, eSign HSM and e-Barimt are ready at the protocol level but run in mock mode while contracts and credentials are pending.

What if I link my E-ID to the wrong account?

Unlink it yourself, under Settings → National identity. With one deliberate exception: if that link is the only way you can sign in, the platform refuses. Set a password or verify a phone number first, then unlink. The refusal exists so that you cannot lock yourself out of your own organisation, instantly, at your own request.

Can somebody send an E-ID prompt to my phone using my registration number?

No. If no account is linked to that registration number the request is refused before it reaches E-ID — otherwise anyone could make a stranger's phone buzz.

Developers

Can I connect my own system?

Yes. Register an OAuth2 client in the developer console and use the standard authorization code + PKCE flow. See Developer console.

Is there a public API?

Yes: a REST API, an OIDC provider (/.well-known/openid-configuration) and webhook subscriptions. See the API reference.

Can I write my own module?

Yes, two ways. Compile a Go module into the platform (Module authoring guide), or ship an external app that connects over OAuth2.

Security

How are passwords and tokens stored?

Passwords with bcrypt. Session tokens, OAuth2 client secrets and issued tokens only ever as a SHA-256 digest — so even somebody who reads the database cannot recover the original value.

Where do sessions live?

Server-side. Signing out and revoking take effect immediately, unlike a client-held JWT that stays valid until it expires.

How do I report a security problem?

See the security policy.