Isolation by design
Every instance has its own private database and its own identity space in nexp IAM. Customers never share tables, credentials or sessions — isolation is part of the architecture, not a setting.
Identity & access, end to end
- Sign-in. Every request is authenticated by nexp IAM (OpenID Connect), with single sign-on, two-factor authentication and brute-force protection.
- Permissions. Apps, roles and groups decide what each person can open — in the web app, the mobile app and the API alike.
- Data rules. Row- and column-level rules are enforced on the server for every request; what a person may not see never leaves the server.
- Server-side logic. Server functions and widget data sources run on the server and are never sent to the browser.
AI agents without access to business data
- Structure, not records. An agent works from how your data is organised and from synthetic sample rows. Your real figures are filled into its reports within your instance and shown only to authorised users; the AI model never receives them.
- Scope Gate. Each agent reads through a user you choose, so it can only use the apps and information that user is allowed to — read-only, with limits on every request.
- Confidential settings stay hidden.App-builder agents see your app's setup with passwords, keys, tokens and connection details removed, and can never change security rules, roles or business data.
- Locked-down reports. Agent reports cannot load or send anything to other sites, and PDFs are rendered with network access blocked.
- Usage limits. Administrators set daily and monthly limits per person and per organisation.
Safe, reversible changes
- Changes an agent suggests are applied only after an authorised person approves them, with that person's rights.
- A snapshot is taken before an agent works on an app, and every change is recorded in an update set.
- Changes can be undone step by step, newest first.
- Releases move between environments with version checks and a full history.
Platform practices
- TLS for all traffic; stored credentials encrypted at rest (AES-256-GCM).
- Encrypted backups before any archive step.
- Signed licences and authenticated control-plane operations.
- Audit logging for administrative, release and lifecycle operations.
- Documentation available to signed-in members only.
Responsible disclosure
We welcome reports from security researchers. Email the details — we acknowledge every report and keep you informed while we investigate. Please do not access other customers' data or degrade the service while testing.
Questions
Security questionnaires and compliance documentation for enterprise customers are handled by [email protected].