Nex Systems

Trust is built into every check.

Nex Systems solutions handle identity documents, screening results and transaction data for regulated institutions. Here is how we protect that information, the trusted partners we build on, and the standards we follow.

Request our security pack Report a security concern

  • Trusted infrastructure

    Hosted on AWS and Microsoft Azure, whose data centers hold ISO/IEC 27001 certification and SOC 1, SOC 2 and SOC 3 reports.

  • ISO/IEC 27001 aligned

    Our information security program follows the ISO/IEC 27001:2022 framework and its Annex A controls.

  • GDPR by design

    Personal data is handled to GDPR principles, with a data processing agreement for every customer.

  • People decide

    Elodie AI prepares findings and evidence. Every compliance decision stays with your team.

Built on trusted partners

Built on infrastructure trusted by the world's banks.

We don't run our own data centers. All Nex Systems solutions run on Amazon Web Services and Microsoft Azure, two of the most audited cloud platforms in the world. Physical security, power, network resilience and hardware are managed by these providers under their own independently audited controls.

Amazon Web Services

Hosting and processing for Nex Systems solutions

Certifications and reports held by the provider

  • ISO/IEC 27001
  • ISO/IEC 27017
  • ISO/IEC 27018
  • SOC 1
  • SOC 2
  • SOC 3
  • PCI DSS
  • CSA STAR

Microsoft Azure

Hosting and processing for Nex Systems solutions

Certifications and reports held by the provider

  • ISO/IEC 27001
  • ISO/IEC 27017
  • ISO/IEC 27018
  • SOC 1
  • SOC 2
  • SOC 3
  • PCI DSS
  • CSA STAR

Certifications and reports listed belong to the named providers and cover their infrastructure services. Customers can obtain these reports directly from AWS Artifact and the Microsoft Service Trust Portal. Product names are trademarks of their respective owners.

Our providers secure the cloud. We secure everything we build on it: the application, access, data handling and configuration, described below.

Our security program

A security program aligned with ISO/IEC 27001.

Our information security management system follows the structure of ISO/IEC 27001:2022. Policies, risk assessment, asset management, access control, supplier management, incident response and business continuity are documented and reviewed.

Our assurance roadmap

  1. Information security policies and Annex A controls documentedIn place
  2. Hosting on ISO/IEC 27001 and SOC 2 audited infrastructureIn place
  3. Independent penetration testUnder evaluation
  4. ISO/IEC 27001 certificationUnder evaluation
  5. SOC 2 reportUnder evaluation

We will update this page as each milestone is reached. Until then, we answer security questionnaires and share our policies under NDA.

How we protect your data

Controls you can ask us about.

This summary matches Annex 2 of our data processing agreement. Further details of specific controls are available on request at privacy@nex.systems.

  • Encryption

    Data is encrypted in transit with TLS 1.2 or higher, and sensitive verification fields are additionally encrypted with keys we rotate. Stored data benefits from the storage protections of our infrastructure providers.

  • Access control

    Role-based permissions, approvals for sensitive actions and least-privilege access to production. Customers can enforce multi-factor authentication and single sign-on for their users.

  • Single sign-on

    Customers can connect their own identity provider through SAML 2.0 or OpenID Connect.

  • Tenant separation

    Each customer's data is logically separated, and access is checked on every request.

  • Audit trail

    Every user action is logged with integrity checks, so decisions can be traced and reviewed.

  • Secure development

    Every change is code-reviewed and passes automated checks before release.

  • Backup and continuity

    Backup, recovery, business continuity and incident response arrangements are in place and described on request.

  • Data location

    Hosting regions are shown in our sub-processor list, available on request. Where available, customers choose where Elodie AI processing runs.

  • Our people

    Staff with access to customer data sign confidentiality agreements and complete security awareness training.

Privacy and GDPR

Privacy designed around GDPR.

We design personal data handling around the EU and UK General Data Protection Regulation, and we support customers subject to other data protection laws in their own markets.

Our role
For all Nex Systems solutions, we act as a processor. We process customer data only on your documented instructions, under a data processing agreement. For our website and business contacts we act as controller, as described in our privacy notice.
Data processing agreement
Our public Data Processing Agreement covers GDPR Article 28 terms, confidentiality, security, sub-processors, audits and deletion.
International transfers
Where data leaves the EEA or UK, we rely on Standard Contractual Clauses and the UK International Data Transfer Addendum, plus supplementary measures where needed.
Breach notification
We notify affected customers without undue delay, aiming for 72 hours, after becoming aware of a personal data breach, so they can meet their own reporting duties.
Data subject rights
We help customers answer access, correction, deletion and objection requests.
Retention
Customers set retention per product. Identity verification records are kept for a period you choose, from one to ten years. At the end of a contract, you can export your data for 30 days; it is then deleted from our systems within 90 days, and from backups in the following backup cycle.
Data minimization
We collect only what each check needs, and our free tools accept typed data only, with no document upload.

Responsible AI

AI assists. People decide.

Read our Responsible AI approach
  • Elodie AI prepares findings, evidence and a recommendation. A person makes every compliance decision.
  • Every AI suggestion shows the evidence it is based on, so reviewers can check it.
  • Customer data is not used to train AI models offered to other customers or by third-party model providers.
  • Where available, customers choose the region where AI processing runs.
  • AI activity is recorded in the audit trail with the reviewer's final decision.

Sub-processors

Who helps us deliver Nex Systems solutions.

We use a small number of carefully selected sub-processors. Each is bound by written data protection terms at least as protective as our DPA. Our sub-processor list, with processing locations, is available to customers on request, and we notify customers who ask to be informed at least 15 days before adding a new sub-processor, as set out in our DPA.

If you buy Nex Systems solutions through an authorized partner, that partner may provide first-line support. Its access to your data is covered by its own agreement with you and with us.

Request the sub-processor list

Security pack and documents

Everything your vendor review needs.

Our security pack is shared with prospective and current customers, under NDA where needed.

Request the security pack

Trust Center questions

Our information security program is aligned with ISO/IEC 27001. All Nex Systems solutions run on AWS and Microsoft Azure infrastructure that holds ISO/IEC 27001 certification and SOC 2 reports. Further independent assurance, including penetration testing, ISO/IEC 27001 certification and SOC 2, is under evaluation. We share our security pack and answer security questionnaires under NDA.

Report a concern

Found a security issue? Tell us.

We welcome reports from researchers and customers. Email security@nex.systems with a description and steps to reproduce. Please don't access or change other people's data, or disrupt the service. We acknowledge reports within two business days and keep you updated until the issue is resolved.

Email security@nex.systemsResponsible Disclosure Policy

Need more for your vendor review?

Ask for our security pack, a DPA or a completed questionnaire. We reply within two business days.

Request the security pack Book a demo