Security, privacy, and compliance for people and the agents they trust.
Nexatron is built by dotSolved for the enterprise. Whether a person or an AI agent sends it, every query runs under the same isolation, governance, and audit logging.
dotSolved Inc holds SOC 2 Type I and ISO 27001. The SOC 2 Type II audit is in progress.
How we protect your data
Tenant isolation
- Every question, whether a person or an AI assistant asks it, is checked against what that individual is allowed to see, at the moment it runs.
- Each customer's connection credentials are stored separately. One customer's keys and cached results never reach another.
- An attempt to reach another customer's data is refused and recorded.
Access & identity
- SSO (OIDC) and SCIM provisioning; MFA and step-up for sensitive actions.
- Role-based access control across the product and platform admin.
- Connections can be authorized per person, so each source system applies its own permissions rather than a shared account flattening them.
Auditability & governance
- One tamper-evident record of every question, whether a person or an AI assistant asked it, plus administrator actions and data access.
- A governed answer carries the exact request that ran, a confidence signal, and links back to the rows it came from; a question that cannot be answered under your rules is refused or clarified instead.
- Policy-aware redaction; DSAR / erasure workflows.
Data protection
- Encryption in transit (TLS) and at rest.
- LLM output is treated as untrusted and validated before any query runs.
- Your data and queries are not used to train foundation models.
Sub-processors
The third parties that may process tenant data to deliver the service. Identity (Keycloak) is self-hosted inside Nexatron's own cloud environment, so it is not a third-party sub-processor.
| Sub-processor | Purpose | Data processed |
|---|---|---|
| Amazon Web Services | Cloud infrastructure: compute, database, object storage | All tenant data, encrypted at rest and in transit |
| Anthropic | LLM (Claude) for natural-language-to-SQL and answer synthesis | Question text and schema/metadata context |
| OpenAI | LLM (GPT) and voice transcription / synthesis | Question text and schema context; voice audio only when voice is used |
| Browser speech recognition (Web Speech API) | Voice audio, only when dictating in Chrome/Edge without on-device recognition | |
| Stripe | Billing and payments (when billing is enabled) | Billing and account metadata only |
Sensitive/regulated tenants can require that voice and LLM processing stay in-region or on-device; contact your account team to scope deployment options.
Deployment that fits your risk profile
Multi-tenant SaaS on AWS, single-tenant VPC, or on-premises by engagement. Bring your own LLM keys. Your data and queries are not used to train foundation models.
We share our SOC 2 report and DPA under NDA. Sub-processor changes are communicated to customers in advance.