Security and trust

Credentials and connections

The keys and passwords you give us to connect your systems are held in a dedicated secrets vault, separate from your workspace data. They are never shown again, to people or to agents. API keys and provisioning tokens are stored only in a form that cannot be read back.

• Reads are available when you connect an app. Each write action stays off until you switch it on for that connection.
• Disconnect an app at any time, and its access stops.

Approved hosts only

Outbound calls go only to the hosts you have approved. Private and internal network addresses are refused. Every workspace is isolated from every other.

Identity and roles

• 12 roles and 85 permissions decide what each person can see and change, with separation of duties built in.
• Enterprise single sign-on with SAML 2.0 or OpenID Connect, with domain verification and the option to require it for everyone in your workspace.
• Automatic joiners and leavers with SCIM 2.0 user and group provisioning.
• Access to production by our team is restricted, granted case by case and audited.

Maker-checker approvals

Policies decide, action by action, whether something runs, waits for a person, or is refused. Limits can be set by amount, by rolling 24 hours, by volume or by field value.

An approval is bound to the exact request, used once, and expires. The person who asked can never approve their own request, and the same rules apply to people, flows and AI agents.

Payments

Payments run through your own payment account, exactly as you set them up. Add approval rules or limits if you want them, and daily reconciliation shows what moved.

Evidence chain

Every policy decision, approval and result is written to an evidence chain. Each entry carries the fingerprint of the one before it, so a changed or missing entry shows up the moment you verify. Export the chain and hand it to an auditor as it is.

Signed audit log

Changes to keys, credentials, policies and members are kept in your workspace's audit log, exportable as a signed file. Every MCP and API call is logged too.

Checks before release

Each flow runs its check cases before a new version reaches production. A failing check holds the release until it passes.

Encrypted in transit and at rest

Every connection to Nexra is encrypted, and your data is encrypted wherever it is stored, including backups.

Backups and recovery

Your data is backed up automatically every day, with point-in-time recovery and copies kept in a separate location, so the service can be restored quickly if something goes wrong.

Monitoring and uptime

We monitor the service around the clock with independent checks every minute. Live status, measured uptime history and incident updates are published on our status page.

Export and erasure

Export a person's data, or erase it when they ask, from the console.

Where your data lives

Where your data is hosted, and the sub-processors we use, are set out in our data processing agreement. We send it on request, along with notice of any change.