Your data stays yours.
Every Nexxorex system runs on your infra with your keys. I engineer security the way SOC 2 auditors expect: masking, logging, scoped tokens, and rotate-anytime access. If your compliance officer has a question, send them here.
How your data is protected,
end to end.
Runs on your infra
Every system we ship deploys to your Vercel / AWS / GCP / on-prem or Dhaka-based hosting. Your API keys, your database, your storage buckets. We never hold your customer data on our servers.
PII masking at the edge
Names, phone numbers, addresses, and bKash / Nagad account IDs stripped before any prompt hits Anthropic / OpenAI. Re-hydrated only in your DB. LLMs never see raw customer data.
Full audit trail
Every AI call, every tool invocation and every database write logged with actor, timestamp, input and output, to an append-only store. Retention configurable to your policy. Exportable for internal audit or a regulator request.
Role-based access + rotation
Every integration uses scoped tokens (read-only, write-only, per-endpoint). Rotate any key in minutes without service disruption. Break-glass admin access logged and alerted.
Prompt injection defense
Every user-controlled input passes through an injection classifier before touching a prompt. Suspicious payloads are quarantined and flagged. Tool-use scoped so a bad prompt can't drain your CRM.
Telecom compliance
Every voice system respects Bangladesh call-recording consent laws, BTRC WhatsApp Business guidelines, and DNC preferences. Bilingual consent recording in Bangla + English.
Frameworks we ship against.
| Framework | Status | Notes |
|---|---|---|
| Chat, orchestration and records | On-premise | Your own data centre or in-country hosting, in both deployment tiers |
| Voice, Standard tier | Hosted speech | Best Bangla quality and lowest latency. Call audio is processed outside Bangladesh |
| Voice, Sovereign tier | Fully on-premise | Entire pipeline inside your network, nothing leaves. Lower accuracy and higher latency than Standard, priced accordingly. The trade-off is quantified for your deployment before you commit |
| Personal data protection | Policy-driven | No Bangladeshi data protection statute is in force yet. We implement your retention, masking and lawful-basis policy, and revisit when the law lands |
| Audit logging | Append-only | Enforced at the database, not in application code. Retention set to your policy |
| AI disclosure | Always on | Callers and chat users are told they are talking to an automated system, in wording you approve |
| Verification before disclosure | Tiered | Which tier unlocks which information is a table your risk team signs off before go-live |
| SOC 2 / ISO 27001 | Not held | No certification and no audit in progress. We can meet and evidence the controls directly, but cannot hand you an auditor's report |
“Aligned” means the controls are in place and ready for an auditor. Formal certifications are pursued per-engagement when your compliance officer requires the letter.
Send this page
to your CISO.
I take a call with any compliance officer, at no charge, before the engagement starts. Every question answered in writing. If we can’t meet a required control, I’ll tell you upfront and refer you to someone who can.
Book intake for security review