> ## Documentation Index > Fetch the complete documentation index at: https://docs.usenexio.com/llms.txt > Use this file to discover all available pages before exploring further. # Security and compliance > Answer the security review questions about where Nexio runs, which model providers see your data, how it is isolated, and how long it is kept. This page states how the platform handles your data, for the architect or security reviewer evaluating an integration. Each fact describes what runs in production. ## Model providers Engines and conversations call models from these three providers: | Provider | Used for | | ------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | OpenAI | Model calls for engines, every conversation instance turn (conversation instances run one OpenAI model), and stateless `POST /converse` calls that name no model or an OpenAI model | | Anthropic | Model calls for engines whose configured model is an Anthropic model, and stateless `POST /converse` calls that name an Anthropic model | | Google Gemini | Web search for the diligence engine type, when Nexio has configured it | The configured model decides the provider for each call. No other model provider is used, and neither the portal nor any browser code calls a model provider directly. **What is sent.** A model call carries the run input (or conversation content), any attachments, and the engine's versioned instructions and output schema. The field-by-field list per provider is on [Data use and subprocessors](/reference/data-use). **Storage at the provider.** Every OpenAI call is sent with `store: false`, which asks OpenAI not to store the request for later retrieval. No equivalent flag is sent to Anthropic or to Gemini. **Processors.** Nexio keeps a declared list of the external processors the platform sends data to. The list has eight processors: Google Geocoding, FEMA National Flood Hazard Layer, HazardHub, OpenAI, Anthropic, Gemini, your webhook receiver, and the authorized recipient of a defensibility packet. [Data use and subprocessors](/reference/data-use) is generated from that list and shows each field, its purpose and its classification. ## Credentials and secrets | What | How it is protected | | -------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- | | Secrets you give Nexio for a connection (database URLs, passwords, tokens) | Encrypted with AES-256-GCM before they are stored. The encryption key is held outside the database, and the service will not start without it | | Webhook signing secrets and receiver auth tokens | Encrypted the same way | | Inbound event source secrets | Encrypted the same way | | API keys | Verified against SHA-256 hashes. The full key is shown once, when it is created | Webhook endpoints must use `https`. Connections to object storage use TLS by default. ## Tenancy Each customer is an organization. The platform takes the organization from the credential on the request (on the inbound event route, from the ingest source), not from the request body. Reads and writes are scoped to that organization, and automated tests check the data stores for cross-organization access. A capability-scoped key is further bound to one environment, a list of engines, and a list of capabilities; a key bound to no engines can run none. See [Authentication and access](/authentication). ## Audit logs | Log | What it records | Who can read it | | --------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------ | | Access log | Every API request except `GET /health`: method, path, route, status, size, duration, request id, client IP address | Nexio, for support and investigation | | Access audit | Every change to access grants and rules, and every effective-access read, including refused ones. It is append-only and written in the same transaction as the change, so a change that cannot be recorded does not happen | You, with your organization's own live key, and Nexio for support. See [Access plane](/data-services/access) | | Run audit trail | The evidence behind each run's output | You, in the portal's Audit tab on the run. Deleted with the run | | Team activity | Invitations, role changes and removals | Admins, under **Settings, then Team** | ## Hosting | Component | Where it runs | | ------------------------- | --------------------------------------------------------------------------------------------------- | | API and worker | Render, in the United States | | Portal | Vercel | | Primary database | CockroachDB | | Job queue | Redis | | File and document storage | S3-compatible object storage | | Portal sign-in | WorkOS | | Portal live updates | Pusher (see [How the platform fits together](/platform-overview#realtime-is-not-a-public-contract)) | The platform runs in a single region. ## Retention | Data | How long it is kept | | ---------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Runs | 90 days, then deleted with their outputs, events, delivery records, usage records and audit trail. The purge runs daily and the window is the same for every organization. A run Nexio flags to be kept indefinitely is not deleted; see [Defensibility](/engines/defensibility). | | Conversations | Kept until you set a retention period on the conversation instance; then conversations expire after that many days without activity. Attachments have their own retention period. See [Export and retention](/conversations/export-and-retention) | | Access audit events | Kept, with no purge | | Inbound event deliveries | Kept, with no purge | | Platform event log | Kept, with no automatic purge | | Records action ledger (notes, tasks, status changes) | Kept, with no automatic purge | | Application records | Kept, with no automatic purge | | Extracted and served data from your documents | Kept, with no automatic purge | ## Monitoring and incidents Nexio measures API success rate, run success, webhook delivery success and the uptime of the health endpoint continuously, against internal objectives. For how an incident looks from your side and how to reach Nexio, see [Operations](/platform/operations). Security questions and incident reports go to [support@usenexio.com](mailto:support@usenexio.com). Every field sent to each processor, with its purpose and classification. Health, deploys, and how to escalate.