Security Overview

Nuxari is designed from the ground up to protect customer data. Security is not a feature, it is a foundational property of how the platform is built, operated, and audited. Every platform action is governed, authorized, logged, and traceable.

This page describes Nuxari's security posture at a trust and policy level. For technical architecture details, see the product security page.

Each organization's data is strictly isolated from all other organizations. No cross-tenant data access is permitted at any layer of the platform, API, database, workflow engine, audit store, or connector layer.

Every query, report, workflow run, audit event, and remediation action is scoped to a single organization. Nuxari enforces tenant isolation as a non-negotiable architectural constraint, not a configuration option.

The Nuxari platform enforces role-based access control (RBAC) across all operations. Users are assigned roles that define what they can view, approve, execute, and audit. No operation proceeds without an authenticated user context and a valid role check.

Minimum privilege is the default. Users receive access to the minimum set of platform capabilities required for their role. Administrative capabilities require explicit role assignment and approval.

All high-impact actions on the Nuxari platform, including access grants, access revocations, remediation execution, connector changes, and administrative configuration changes, require explicit human authorization before they are executed.

No automated process, AI assistant, or background job executes a high-impact action without a prior approval step. Approval decisions are recorded in the audit log along with the approver's identity, timestamp, and rationale.

Every meaningful platform action generates a tamper-evident audit event. Audit events include the actor's identity, the target resource, the action taken, the outcome, and a timestamp. Audit logs are available to authorized users within the platform.

Audit events are designed to support evidence collection for internal reviews and external audits. They cannot be retroactively altered through normal platform operations.

Audit logs do not contain raw passwords, private keys, API secrets, or other sensitive credentials. Credential values are redacted before storage.

Nuxari does not require customers to submit raw passwords, private keys, or API secrets through the platform UI. Where integration credentials are required (such as for connector configuration), they are:

• ·Encrypted at rest before storage
• ·Never exposed in full through the platform interface after initial submission
• ·Redacted from audit logs and error messages
• ·Accessible only to the platform's integration layer under controlled conditions

Evidence packages generated by the Nuxari platform are cryptographically chained. Once an evidence record is committed, it cannot be retroactively altered without detection. This design ensures that audit evidence submitted to external reviewers reflects the actual state of platform operations at the time actions occurred.

Nuxari connectors and edge agents operate with the minimum permissions required to perform their designated integration functions. Connector credentials are encrypted at rest and are not exposed in platform logs.

The connector lifecycle, including registration, credential rotation, deactivation, and removal, is governed and fully audited. Each lifecycle event is recorded with actor identity and timestamp.

Connectors do not grant themselves additional permissions. Scope expansions require explicit administrative approval and generate audit events.

The Nuxari AI governance assistant can classify intent, recommend workflows, summarize findings, and suggest remediation actions. It cannot execute privileged actions independently.

All AI-recommended actions require human review and explicit approval before the platform executes them. The AI assistant is advisory, not authoritative. It does not override RBAC, bypass approval workflows, or call external systems directly.

AI interactions that result in workflow initiation are logged in the audit trail, including the recommendation that was generated and the human decision that followed.

Nuxari maintains an incident response process for detecting, containing, and remediating security incidents. In the event of a confirmed security incident affecting customer data, Nuxari will notify affected customers without undue delay and in accordance with the timeframes specified in the applicable agreement.

Incident notifications will include, to the extent available at the time of notification, a description of what occurred, the categories of data potentially affected, and the steps Nuxari is taking to address the incident.

If you believe you have found a security vulnerability in the Nuxari platform or website, please report it responsibly. Do not publish vulnerability details before Nuxari has had a reasonable opportunity to investigate and address the issue.

To report a security vulnerability, contact: security@nuxari.com

For more details on our disclosure process, see the Responsible Disclosure policy.

Nuxari is designed to support compliance workflows and help organizations collect audit-ready evidence for internal reviews and external assessments. The platform maps operational actions to controls, maintains tamper-evident audit logs, and enforces approval-controlled remediation.

Nuxari does not currently hold formal certifications such as SOC 2 Type II or ISO 27001. Certification status will be published on this page when formally achieved.

Nuxari does not claim to guarantee any specific compliance posture or audit outcome. Platform customers are responsible for their own compliance determinations.