Security & trust

Autonomous, but accountable.

Nexus investigates on its own, and explains every step. Humans hold the keys to anything that changes your environment, behind approval gates, scoped permissions, and a tamper-evident audit trail.

Human-in-the-loop

Autonomy you can actually trust.

Nexus is autonomous in investigation and supervised in action. Every reasoning step is recorded, every verdict is scored, and anything destructive waits for a person to sign off.

  • Explainable reasoning tracesEvery hypothesis, the evidence behind it, and the verdict are logged in plain, reviewable steps.
  • Calibrated confidence scoringEach automated verdict carries a confidence score, low-confidence calls escalate instead of acting.
  • Supervised approval gatesDestructive actions block pending a single-click, cryptographically signed approval from authorised staff.
  • Reversible by defaultEvery action is rollback-verified before it runs, so automation never breaks production.
response plan // INC-4471LIVE
Isolate compromised endpointAuto-approved · low blast radius
DONE
Revoke leaked Okta sessionAuto-approved · scoped
DONE
Rotate production IAM keysAwaiting analyst approval
HOLD
Quarantine S3 bucketRequires lead approval
REVIEW
The trust matrix

Controls built into every layer.

Protecting high-value infrastructure means holding our own internals to the same standard. Zero implicit trust, across identity, data, and every action Nexus takes.

Scoped permissions & RBAC

Least-privilege roles map each analyst to specific scopes. Consequential actions require multi-party or supervisory sign-off.

Hardware MFA Just-in-time access Session timeouts

Tamper-evident audit trail

Every reasoning step, enrichment call, and human override is signed and written to immutable WORM storage you can replay.

Signed ledger WORM storage SIEM forwarding

End-to-end encryption

TLS 1.3 in transit, AES-256 at rest, with continuous key rotation. HSM-backed keys protect the reasoning indexes.

TLS 1.3 AES-256-GCM BYOK ready

Tenant isolation

Logical and physical boundaries keep each customer's data and memory separate. No cross-tenant learning, ever.

VPC isolation Per-tenant keys Memory sandboxing

Full explainability

No black boxes. Trace any verdict back to the signals, hypotheses, and confidence scores that produced it.

Reasoning traces Evidence chain Confidence scores

Safe execution

Approval gates, blast-radius checks, and verified rollback wrap every action that touches a live system.

Blast-radius checks Rollback verified Kill switch
trust-pipeline // action → approval → ledger
ACTION APPROVAL GATE human sign-off LEDGER SIGNED · WORM
08:14:02 endpoint isolated 0x7af3…c1
08:14:09 okta session revoked 0x91d0…4e
08:15:41 iam rotation approved 0xbb27…a9
Audit trail

A signed record of every decision.

Nothing happens off the record. From the first signal to the final containment step, Nexus writes a cryptographically signed, tamper-evident ledger entry, forensically defensible and ready for any auditor.

  • Immutable WORM ledgerWrite-once, read-many storage means entries can be verified but never quietly altered.
  • Attributed to a person or agentEach entry names the analyst or agent responsible, with the signing key that authorised it.
  • Streamed to your SIEMForward the full trail into Splunk, Sentinel, or your data lake in real time.
Compliance

Audited against the standards you answer to.

Independent attestations and data-residency controls, so Nexus clears your procurement and risk reviews on the first pass.

SOC 2 Type II

Continuous independent attestation of security, availability, and confidentiality controls.

ISO 27001

A certified information security management system with ongoing vulnerability remediation.

GDPR

Regional data-residency zones keep EU identity data inside European facilities.

HIPAA Ready

Data minimisation and signed BAAs for healthcare operational environments.

Review our security posture in detail.

Request an NDA pack for full penetration test reports, system design docs, and current attestations.

Request Demo Review architecture