Security | Nyraxis

1. Platform controls

Organization scope

Resources are associated with organizations and protected through application authorization. A full role and tenant-isolation verification matrix remains part of release acceptance.

API credentials

API keys are used to authenticate integrations. Keep keys in a secrets manager, scope their use to the intended workspace and revoke them when no longer needed.

Transport and deployment

Use HTTPS for hosted traffic and verified TLS for remote database connections. Storage encryption and network boundaries must be checked in the deployed environment.

Connection secrets

Saved connection credentials are encrypted and masked in account views. Restrict access to authorized workspace members and rotate credentials when required.

Data capture

Metadata-only workload storage is the default, with an administrator-controlled capture ceiling. Review capture settings and evaluation destinations before sending sensitive data.

Audit records

The product records selected administrative and security events. Coverage and tamper resistance must be verified; ordinary database audit records are not an immutability guarantee.

2. Authentication and access

Session-based access
Organization role checks
TOTP and passkey flows available for deployment verification
Enterprise OIDC/SAML integration requires identity-provider setup and acceptance tests

3. Where your data lives

Confirm the selected region and processing destinations for your deployment. Evaluation APIs, model-backed detectors, judging services, telemetry and transactional email can have separate destinations. Review these alongside the Privacy Policy before sending sensitive data.

4. Data handling

Review your workspace's retention settings and verify that cleanup runs successfully in the deployed environment. Historical content and backup expiry require separate review.
We recommend running red-team scans against staging agents with synthetic data, not production systems holding real user data.
You can request full deletion of your organization's data via support@nyraxis.io.
Private deployments require an approved endpoint and egress configuration; location alone does not prove that all processing stays within the boundary.

5. Verify before rollout

Start with synthetic data, inspect successful and incomplete checks, and verify the enforcement path in your application. A passing test covers its specific inputs and configuration. Review the integration scope and request deployment-specific evidence.

6. Compliance roadmap

We do not claim a SOC 2 assurance report. Policy templates, private hosting and product reports do not provide independent assurance. Ask us for the current evidence and limitations relevant to your procurement requirements.

7. Responsible disclosure

Found a vulnerability in Nyraxis itself? We want to hear from you. Report it to support@nyraxis.io with the subject "Security disclosure". Please give us a reasonable window to investigate and remediate before public disclosure. We commit to acknowledging reports promptly and keeping you updated.