What we hold, and what we do not.
Three of the nine items below say “not yet held”. They are on the page because your risk team will find out anyway, and finding out from us first is worth more than a row of green ticks. Security questions to security@nexxorex.com.
Data residency
Two deployment tiers, and the difference is stated before you choose rather than discovered afterwards. Standard runs the speech layer as a hosted service: best Bangla quality, lowest latency, lowest cost per minute, and call audio is processed outside Bangladesh. Sovereign runs the whole pipeline inside your own data centre with nothing leaving your network, which costs accuracy and adds latency, and is priced accordingly. Chat, orchestration and your records run on your own infrastructure in both tiers. Which tier suits you is settled at the diagnostic.
Audit trail
Every interaction, every operation performed against your systems and every handover is written to an append-only store. Append-only is enforced at the database, not by application code that a later release could quietly change. Retention is set to your policy rather than ours.
AI disclosure
Callers and chat users are told at the start that they are talking to an automated system, and the wording is yours to approve. We do not build systems designed to leave the customer unsure, and we will not accept a scope that asks for it.
Verification before disclosure
What the layer will disclose at each verification tier is written as a table your risk team reviews and changes before go-live. Public information is open. Anything account-specific is gated. Anything that moves money goes to a person by design.
Encryption
TLS 1.3 in transit across every service boundary, AES-256 at rest across managed stores, and per-tenant key isolation. Standard rather than remarkable, and listed here because procurement asks.
Outbound contact rules
Contact windows, frequency caps, escalation paths and opt-out handling are agreed in writing before any outbound campaign dials, and every attempt with its outcome is logged against the account. We enforce the limits you set rather than a US carrier framework that does not apply here.
BTRC Call Centre Licence
Required where we would operate the contact centre ourselves rather than build a system you operate. Where a deployment needs it, the access line comes from a licensed PSTN or IPTSP operator and the short code is applied for separately. If your procurement requires the licence on our side, say so early, because it changes the delivery shape.
ISO 27001 · ISO 9001
Commonly required in government and state-owned enterprise tenders, alongside BACCO and BASIS membership and a minimum operating history. We do not hold the certifications today. For tenders that mandate them, the route is a consortium with a certified systems integrator, and we will tell you that rather than let a bid fail on a box we cannot tick.
SOC 2
There is no SOC 2 audit in progress and no letter of engagement. This page previously said otherwise. If your security review needs third-party attestation, the honest answer today is that we can meet the controls and evidence them directly, but we cannot hand you an auditor's report.