Security

Enterprise runs in your own AWS account. The entire stack is Terraform, deployed into your VPC. Your data never reaches our infrastructure. For hosted plans we run in AWS us-east-1.

Connected sources stay where they are. We cache computed aggregates to keep dashboards fast, and increasingly push aggregation into your warehouse so rows are never fetched at all.

Authentication happens at the load balancer via OIDC, and the application verifies the signed identity token rather than trusting any header. Roles are viewer, manager and admin, checked server-side on every API route.

Row-level security is enforced at a single point in the compute engine, so dashboards, exports, AI answers, Slack digests and embedded views all inherit the same scope. A policy that cannot be resolved yields no rows rather than all rows.

The AI analyst is read-only by construction. It generates no SQL, has no write path, and cannot reach raw rows. It reads the same pre-computed, access-scoped aggregates shown on screen. Your data is not used to train any model.

Credentials for your data sources are stored as encrypted parameters in AWS Systems Manager and injected into the running container at start. They are never committed to source control, never baked into a container image, and never written to our application storage.

The product records who viewed, exported, published and changed what, with timestamps and client IP. That log is a customer-facing record, exportable for your own compliance needs.

We are not SOC 2 certified today, and we are not ISO 27001 certified. We build to those controls and intend to certify; we will not claim a certification we do not hold. If your procurement process requires one, tell us early and we will be straight with you about timing.

Email security@nexourz.com with steps to reproduce. We will acknowledge within two business days. We will not pursue legal action against researchers who act in good faith, avoid privacy violations and data destruction, and give us reasonable time to fix an issue before disclosing it.