Security, privacy and proof you can check.
This is how Nexus keeps customers apart, who holds the keys, where your data lives, and how your records answer the rules you work under. If you need something that is not here, ask us.
Built so a mistake stays small.
Each layer assumes the one above it can fail. If something goes wrong in one place, it stays there.
Kept apart
Each customer, unit and domain runs in its own space, with isolation tested every day.
Keys you hold
Encryption keys per space, held in your own key store if you prefer. Erase the key and the data is gone.
Files read in a sandbox
Every uploaded file is opened inside a sealed micro-machine with no network, then thrown away.
A shield at the edge
Firewall rules, rate limits and bot checks in front of every platform, with every change recorded.
Your data, where your rules say.
You choose where each kind of data is stored and processed. In our EU cloud, data stays in the European Union. Personal data can be found, exported or erased on request, and the request itself is recorded.
- Data residency set per kind of data
- Find, export or erase one person's data
- Memory that asks for consent and forgets on request
- We act as your processor under a data processing agreement
Read our privacy notice and cookie notice.
Every obligation, mapped to its evidence.
Each rule is linked to the sealed records that answer it, so an auditor can follow the line from the article to the evidence.
until the EU AI Act's rules for high-risk AI apply to credit scoring and to life and health insurance pricing, on 2 December 2027.
DORA already applies to banks and insurers today. Every rule comes down to proof. A platform built on Nexus keeps that proof from the first request.
Choose any date on the line. The clock counts down to a rule, then counts the days it has applied.
- EU AI ActRegulation (EU) 2024/1689Human oversight, record keeping and transparency for AI
- DORARegulation (EU) 2022/2554Register of tech suppliers, incident reports and exit plans
- GDPRRegulation (EU) 2016/679Purpose, access, erasure and where data lives
- NIS2Directive (EU) 2022/2555Incident reporting clocks and supply-chain security
- ISO/IEC 420012023 · AI management systemsPolicies, roles and controls for AI in use
- ISO/IEC 270012022 · Information securityAnnex A controls, evidence and audits
- Solvency IIDirective 2009/138/ECGovernance and record keeping for insurers
- MiFID IIDirective 2014/65/EURecorded calls and walls around research
AI Act dates as amended by Regulation (EU) 2026/1744, the Digital Omnibus, published in the Official Journal on 24 July 2026. Not legal advice.
Certification stays between you and your auditor.
Nexus does not certify you. It keeps the evidence your auditor needs: controls, risks, policies, incidents and the records behind them, collected as the work happens. Your auditor reviews it in a room of their own and reaches their own view.
- Statement of applicability
Which controls apply, why, and where the evidence lives.
- Evidence that collects itself
Records filed against controls as people and agents work.
- The auditor's room
Read-only access to exactly what the auditor asked for.
Found something? Tell us.
Write to our security team. A person reads every report, and we keep you updated until it is fixed. Please do not test against other customers' data.
How to report a security issueWhat customers can ask for
Our list of subprocessors, the data processing agreement, security questionnaire answers and architecture notes are shared with customers and prospects under a non-disclosure agreement.
Ask for the documentsBring your security team.
We will walk them through isolation, keys, data residency and the records behind every decision, and answer their questionnaire.