Security overview

Every request to Nexoviaai is treated as sensitive. These are the controls that protect your keys, your data and the credentials we hold with model providers.

Pre-launch. This page describes the controls the platform is being built with. Each is verified before general availability, and we update this page as they go live.

Infrastructure

• The gateway runs on Cloudflare's global network, with built-in DDoS protection.
• All traffic is encrypted in transit with TLS 1.2 or higher, including between the gateway and model providers.
• Stored data is encrypted at rest by our database and cache providers.
• Production, staging and development are separate environments with separate credentials.

API keys

• Your API keys are shown once at creation and stored only as a one-way hash.
• Each key can be limited to specific models, budgets and rate limits, and given an expiry date.
• Admins can revoke or rotate any key instantly from the dashboard.
• Our own provider credentials live in an encrypted secrets store, never in code, and are rotated at least every 90 days.

Access control

• Customer dashboards use roles: Owner, Admin, Developer, Billing and Read-only.
• Our staff access production on a least-privilege basis, with multi-factor authentication on every system.
• Staff do not view customer content logs except to resolve a support request you raise, and every access is logged.
• Access is reviewed every quarter and removed on the day someone leaves.

Monitoring and abuse prevention

• We log administrative actions, sign-ins and gateway errors, and alert on unusual spend, error spikes and suspected leaked keys.
• We act on abuse notices from model providers and enforce our Acceptable Use Policy.
• Customers are verified and screened against sanctions lists before production access.

Resilience

• If a provider fails, requests can fail over to a backup model you have approved in your routing policy.
• Databases are backed up daily, and restores are tested every quarter.

People and process

• Everyone with production access signs confidentiality terms and completes security training when they join and every year after.
• Code changes are reviewed before deployment, and dependencies are scanned for known vulnerabilities.
• We follow a written incident response plan and notify affected customers as set out in our Data Processing Agreement.

Contact

Security questions and questionnaires: security@nexoviaai.com. To report a vulnerability, see responsible disclosure.