Security and compliance

This page states how the platform handles your data, for the architect or security reviewer evaluating an integration. Each fact describes what runs in production.

Model providers

Engines and conversations call models from these three providers:

Provider	Used for
OpenAI	Model calls for engines, every conversation instance turn (conversation instances run one OpenAI model), and stateless `POST /converse` calls that name no model or an OpenAI model
Anthropic	Model calls for engines whose configured model is an Anthropic model, and stateless `POST /converse` calls that name an Anthropic model
Google Gemini	Web search for the diligence engine type, when Nexio has configured it

The configured model decides the provider for each call. No other model provider is used, and neither the portal nor any browser code calls a model provider directly. What is sent. A model call carries the run input (or conversation content), any attachments, and the engine’s versioned instructions and output schema. The field-by-field list per provider is on Data use and subprocessors. Storage at the provider. Every OpenAI call is sent with store: false, which asks OpenAI not to store the request for later retrieval. No equivalent flag is sent to Anthropic or to Gemini. Processors. Nexio keeps a declared list of the external processors the platform sends data to. The list has eight processors: Google Geocoding, FEMA National Flood Hazard Layer, HazardHub, OpenAI, Anthropic, Gemini, your webhook receiver, and the authorized recipient of a defensibility packet. Data use and subprocessors is generated from that list and shows each field, its purpose and its classification.

Credentials and secrets

What	How it is protected
Secrets you give Nexio for a connection (database URLs, passwords, tokens)	Encrypted with AES-256-GCM before they are stored. The encryption key is held outside the database, and the service will not start without it
Webhook signing secrets and receiver auth tokens	Encrypted the same way
Inbound event source secrets	Encrypted the same way
API keys	Verified against SHA-256 hashes. The full key is shown once, when it is created

Webhook endpoints must use https. Connections to object storage use TLS by default.

Tenancy

Each customer is an organization. The platform takes the organization from the credential on the request (on the inbound event route, from the ingest source), not from the request body. Reads and writes are scoped to that organization, and automated tests check the data stores for cross-organization access. A capability-scoped key is further bound to one environment, a list of engines, and a list of capabilities; a key bound to no engines can run none. See Authentication and access.

Audit logs

Log	What it records	Who can read it
Access log	Every API request except `GET /health`: method, path, route, status, size, duration, request id, client IP address	Nexio, for support and investigation
Access audit	Every change to access grants and rules, and every effective-access read, including refused ones. It is append-only and written in the same transaction as the change, so a change that cannot be recorded does not happen	You, with your organization’s own live key, and Nexio for support. See Access plane
Run audit trail	The evidence behind each run’s output	You, in the portal’s Audit tab on the run. Deleted with the run
Team activity	Invitations, role changes and removals	Admins, under Settings, then Team

Hosting

Component	Where it runs
API and worker	Render, in the United States
Portal	Vercel
Primary database	CockroachDB
Job queue	Redis
File and document storage	S3-compatible object storage
Portal sign-in	WorkOS
Portal live updates	Pusher (see How the platform fits together)

The platform runs in a single region.

Retention

Data	How long it is kept
Runs	90 days, then deleted with their outputs, events, delivery records, usage records and audit trail. The purge runs daily and the window is the same for every organization. A run Nexio flags to be kept indefinitely is not deleted; see Defensibility.
Conversations	Kept until you set a retention period on the conversation instance; then conversations expire after that many days without activity. Attachments have their own retention period. See Export and retention
Access audit events	Kept, with no purge
Inbound event deliveries	Kept, with no purge
Platform event log	Kept, with no automatic purge
Records action ledger (notes, tasks, status changes)	Kept, with no automatic purge
Application records	Kept, with no automatic purge
Extracted and served data from your documents	Kept, with no automatic purge

Monitoring and incidents

Nexio measures API success rate, run success, webhook delivery success and the uptime of the health endpoint continuously, against internal objectives. For how an incident looks from your side and how to reach Nexio, see Operations. Security questions and incident reports go to support@usenexio.com.

Data use and subprocessors

Every field sent to each processor, with its purpose and classification.

Operations

Health, deploys, and how to escalate.

Start here

Engines

Conversations

Connections and data

Records

Events and webhooks

Platform

Reference

Security and compliance

Model providers

Credentials and secrets

Tenancy

Audit logs

Hosting

Retention

Monitoring and incidents

Data use and subprocessors

Operations

​Model providers

​Credentials and secrets

​Tenancy

​Audit logs

​Hosting

​Retention

​Monitoring and incidents

Data use and subprocessors

Operations

Model providers

Credentials and secrets

Tenancy

Audit logs

Hosting

Retention

Monitoring and incidents