The discipline is the trust.
A candid view of NEXI's security posture, data-handling practices, and compliance roadmap.
Open
Ships open under Apache 2.0, with a public LICENSE drop in June. Any party can re-derive a receipt without NEXI.
Honest
The defensible novelty is the specific combination. The prior art it builds on is cited by name.
Hardened
Runs on Vercel and Google Workspace, both SOC 2 Type II and ISO/IEC 27001 attested. NEXI's are in progress.
01Who we are
NEXIVERIFY is operated by Nexi Technologies, Inc., a Delaware corporation. NEXI is an early-stage technology company building a verification layer for AI: an open Apache 2.0 reference verifier at the floor, three commercial packs above, and a signed-receipt format that any party can independently re-derive.
The honest summary of NEXI's stage today: a small team operating to the security and privacy practices appropriate for an early-stage company with no live commercial product, building toward the controls appropriate for the regulated buyers we expect to engage in 2026 and 2027. This page describes that posture accurately. Where a control is in place, it says so. Where a control is planned or out of scope, it says that too.
02The open substrate is the trust anchor
The single most important sentence on this page is the one that follows: the verification format and the reference verifier are published under Apache 2.0, and any party can re-derive any receipt without NEXI in the trust path.
That commitment is the structural foundation of every other commitment on this page. It is the answer to “what happens if NEXI folds” (the verifier keeps running, receipts stay re-derivable). It is the answer to “can our audit firm attest to your output” (yes — the format is open and auditable). It is the answer to “are we stranded if we adopt this” (no — there is no NEXI-only format).
The LICENSE drop on the substrate is scheduled for June. After that date, the Apache 2.0 terms govern any use of the reference verifier. NEXI's commercial obligations to enterprise customers continue under separate agreements (Enterprise Agreement, DPA), but the substrate itself is not gated on those agreements.
03Security controls
The controls below are organized by domain. Each row carries an honest status: live means the control is in place today, planned means it is on the current roadmap with an internal target, and out of scope means we have made a deliberate decision not to implement the control at this stage.
Identity and access
Data protection
Application and network security
Operations
04Data handling and AI
NEXIVERIFY is a verification layer. Three commitments shape how data is handled:
- No training on customer or visitor data. NEXI does not train, fine-tune, or otherwise use customer or visitor personal data to train artificial-intelligence or machine-learning models, and does not provide that data to third parties for that purpose.
- Open verifier; no NEXI-only format. Customers and any third party can re-derive any receipt without NEXI in the trust path.
05Incident response
NEXI maintains an internal incident-response process covering detection, triage, containment, recovery, and post-incident review, and will notify affected parties and any authorities where applicable law requires.
To report a suspected security incident or vulnerability, email security@nexiverify.com. NEXI commits not to take legal or administrative action against good-faith security researchers who report vulnerabilities to that address.
06Compliance and certifications
The honest picture on third-party certifications and regulatory readiness as of the Effective Date below.
Aspirational targets above are not commitments. They reflect the current internal plan, gated on funding, auditor engagement, and the first paid mandate. Where a target slips, this page is updated.
07Document library
Most trust centers are rendered by a third-party compliance vendor: the controls are read out of that vendor's dashboard, and the documents sit behind that vendor's request gate. This one is self-hosted on purpose — and the verification layer it is built to be attested by is our own. The end state is for every control on this page to carry a signed receipt you can re-derive with the open verifier, so the posture above becomes something you check rather than something you take on faith. We are not there yet; the status pills stay honest until that substrate attests them.
Documents already published are linked directly. Documents we provide under agreement or on request open a pre-addressed email. Documents still in preparation say so plainly, with no request path until they exist.
Published
Available on request
In preparation
08Receipts you can re-check
The strongest trust artifact NEXI publishes is not a certification logo. It is a receipt anyone can run the open verifier against. We will list reviewer-runnable receipts here as they are released, with the verifier version and the expected pass result for each.
The first such artifact — an honest workflow run alongside a tampered one, with the open verifier catching the tampered receipt in under a second — will be published alongside the LICENSE drop in June.
09How to contact us
- Trust and security questions. trust@nexiverify.com
- Vulnerability reports. security@nexiverify.com
- Privacy and data-subject requests. privacy@nexiverify.com
- Procurement, DPA requests, security questionnaires. legal@nexiverify.com