Built around governance execution, not dashboards.

Connector Layer

Connectors integrate Nuxari with external systems. Each connector handles two directions: reading current access state and writing approved changes back to the system. Connectors are stateful, they track last-sync time, object counts, and health status.

Connector credentials are encrypted at rest using per-tenant encryption. Credentials are never returned in API responses and are never logged. Connector lifecycle events, activation, disablement, credential rotation, archival, are all audited.

Edge Agent Layer

Edge Agents extend governance to environments that cannot be reached via cloud APIs, on-premises Active Directory, air-gapped networks, OT/ICS systems, and private VPCs. Agents operate with outbound-only connectivity: no inbound ports, no VPN tunnels, no firewall exceptions required by Nuxari.

Evidence is hashed on the agent before upload, providing tamper-evidence in transit. Agent tokens are short-lived and hashed at rest.

Policy Engine

The Policy Engine is the comparison layer. It maintains approved access baselines per tenant and continuously compares them against observed access reported by connectors. Deviations become findings, classified by severity and mapped to control references.

Policies follow an inheritance model: org-level policies (platform defaults) cannot be reduced by tenant admins. Tenants customize within bounds. This ensures governance minimums are always enforced regardless of tenant configuration.

Evidence Store

The Evidence Store persists all workflow outputs with cryptographic integrity. Every evidence record is SHA-256 hashed. Evidence packages use a Merkle tree structure, the root hash covers all records, making tampering detectable.

Evidence records are immutable after creation. They cannot be deleted by tenant admins within the configured retention window. Export produces a signed package with all hashes and the Merkle root.

Data Flow

Tenant Isolation

Every piece of data in Nuxari belongs to exactly one organization. Every query, API response, and export is scoped to the requesting tenant's organization ID. There is no admin bypass for tenant isolation, even platform operators cannot read a tenant's data through normal API paths.