Security, privacy, and compliance for people and the agents they trust.
Nexatron is built by dotSolved for the enterprise. Whether a person or an AI agent sends it, every query runs under the same isolation, governance, and audit logging.
dotSolved Inc holds SOC 2 Type I and ISO 27001. The SOC 2 Type II audit is in progress.
How we protect your data
Tenant isolation
- Every query, whether a person or an AI agent sends it, filters by tenant. Row- and column-level security is enforced at execution.
- Per-tenant credential vault; one tenant's keys and cache never reach another.
- Cross-tenant access attempts are rejected and audited.
Access & identity
- SSO (OIDC) and SCIM provisioning; MFA and step-up for sensitive actions.
- Role-based access control across the product and platform admin.
- Per-user OAuth for connected SaaS sources, so the source enforces its own field-level security.
Auditability & governance
- Hash-chained audit log of human and agent queries, admin actions, and data access.
- Every answer carries the exact query that ran, a confidence score, and links to source rows.
- Policy-aware redaction; DSAR / erasure workflows.
Data protection
- Encryption in transit (TLS) and at rest.
- LLM output is treated as untrusted and validated before any query runs.
- Your data and queries are not used to train foundation models.
Sub-processors
The third parties that may process tenant data to deliver the service. Identity (Keycloak) is self-hosted inside Nexatron's own cloud environment, so it is not a third-party sub-processor.
| Sub-processor | Purpose | Data processed |
|---|---|---|
| Amazon Web Services | Cloud infrastructure: compute, database, object storage | All tenant data, encrypted at rest and in transit |
| Anthropic | LLM (Claude) for natural-language-to-SQL and answer synthesis | Question text and schema/metadata context |
| OpenAI | LLM (GPT) and voice transcription / synthesis | Question text and schema context; voice audio only when voice is used |
| Browser speech recognition (Web Speech API) | Voice audio, only when dictating in Chrome/Edge without on-device recognition | |
| Stripe | Billing and payments (when billing is enabled) | Billing and account metadata only |
Sensitive/regulated tenants can require that voice and LLM processing stay in-region or on-device; contact your account team to scope deployment options.
Deployment that fits your risk profile
Multi-tenant SaaS on AWS, single-tenant VPC, or on-premises by engagement. Bring your own LLM keys. Your data and queries are not used to train foundation models.
We share our SOC 2 report and DPA under NDA. Sub-processor changes are communicated to customers in advance.