Nyraxis AI
FeaturesHow it worksPricingAssessmentDocsBlog

Security

Security at Nyraxis. Held to the standard we sell.

We build a security product, so we hold ourselves to the standard we sell. This page describes how the Nyraxis platform itself is secured, where your data lives, and how to report a vulnerability.

Platform security

Organization-scoped data isolation

All customer data (traces, scan results, policies, reports) is scoped to your organization in our multi-tenant Postgres. Queries are filtered by organization at the application layer, so one workspace can never read another's data.

API keys hashed at rest

Ingestion API keys are stored hashed (bcrypt over SHA-256), never in plaintext. A database read does not expose usable keys.

Encryption in transit and at rest

TLS everywhere: dashboard, API, and SDK ingestion. The database is encrypted at rest.

Secrets management

Platform secrets live in dedicated cloud secrets management, not in code, images, or environment files.

Private networking

Internal services run on private networking. The database and internal workers are not exposed to the public internet.

Audit logging

Administrative and security-relevant actions are recorded in audit logs.

Authentication and access

  • Session-based authentication via Better Auth
  • Two-factor authentication (TOTP)
  • Passkeys (WebAuthn)
  • SSO (OIDC / SAML) on enterprise plans
  • Role-based access control within organizations

Where your data lives

The platform is hosted on AWS in the EU (Ireland), and all stored customer data lives there. Red-team scan simulation uses LLM processing via AWS Bedrock, and transactional email is delivered via Amazon SES. These processing paths are also disclosed in our Privacy Policy.

Data handling

  • Agent traces and outputs are retained according to your workspace's retention settings.
  • We recommend running red-team scans against staging agents with synthetic data, not production systems holding real user data.
  • You can request full deletion of your organization's data via harsh@nyraxis.io.
  • Self-hosted deployments keep all data inside your own infrastructure.

We scan ourselves

Our own demo and internal agents are continuously tested with the same red-team engine we ship to customers. We dogfood the product; findings from our own scans feed directly into the attack library.

Compliance roadmap

SOC 2 Type I is planned. We are not certified today, and we won't claim otherwise. If your procurement process requires specific attestations, talk to us and we'll tell you exactly where we stand.

Responsible disclosure

Found a vulnerability in Nyraxis itself? We want to hear from you. Report it to harsh@nyraxis.io with the subject "Security disclosure". Please give us a reasonable window to investigate and remediate before public disclosure. We commit to acknowledging reports promptly and keeping you updated.