Security and trust
You are being asked to put confidential material into someone else's software. This page explains, in plain terms, what protects it — and what we are not claiming.
What protects your material
Document recognition and analysis run on hardware we own and control, not on someone else's platform. In normal processing, no outside model provider ever receives your material — there is no API call carrying your case documents to a company you have never heard of.
Where an outside model would genuinely add something, we tell you before it runs, on that specific matter, and we do not proceed without your approval. Decline it and the matter is handled entirely in-house. There is no default that quietly sends your material out.
Processing runs on fixed local models rather than a service that changes underneath you. Re-run a document a year from now and you get what you got the first time — which is what lets a finding be defended rather than merely asserted.
When you send us a file, it is locked inside your own browser before any of it travels to us. The key that opens it stays on the review machine and is never sent with the file. What sits on our servers is a sealed file we have no way to open.
Signing in once does not hand out a key to the building. Every action — opening a matter, viewing a document, downloading a report — is checked again against who you are and what you are allowed to see.
Every entry is sealed to the one before it, like a numbered page in a bound book. If an event were removed or altered after the fact, the sequence would no longer add up — so the record can be checked rather than taken on trust.
Once your uploads reach the secure review storage, the cloud copy is deleted. Finished work is not put in the cloud at all until you ask for it — you press a button, a copy appears for you to collect, and it is removed once you have it. If you never collect it, it is removed anyway.
Files are scanned for malware when they arrive, and scanned again on the machine where they are actually reviewed. Anything that fails is held aside rather than passed along.
The drives holding case material are encrypted, and each matter is walled off so it can only be reached by someone authorized for it. There are also limits on how often files can be uploaded, downloaded, or administered, so no account can quietly pull everything at once.
If your IT provider or security reviewer wants the technical detail behind any of this — the specific encryption used, how keys are held, how the audit record is constructed — we will provide it. Just ask.
What we are not claiming
NexusIIP does not hold SOC 2, FedRAMP, or CMMC certification today — these are formal audits a company pays to undergo, and we have not completed them. We are building toward CMMC Level 2. If a young platform tells you it is already certified, ask to see the report.
Early demonstrations and testing run on made-up, public, or de-identified material. We do not practice on somebody else's case file.
The addresses on this site are normal email, and normal email is not private. Do not send privileged communications, sensitive government material, medical records, or case files to them. Secure intake is set up separately, and we will confirm it with you in writing first.
NexusIIP organizes material and shows you what it is based on. It does not exercise judgment, and it is not a substitute for yours. Everything it produces is meant to be reviewed before it is relied on.
Telling us about a problem
If you come across something that looks like a security problem — a document you should not be able to see, an account behaving oddly, anything that feels off — tell us. Start with a short description of what you noticed. Do not include sensitive material in that first message; we will set up a safe way to share the details.
Report a security concernQuestions before you commit
We expect to be asked. Send over your firm's security questionnaire, or bring whoever handles your IT, and we will work through it with you.
Founder access is limited to the first 25 customers. No payment is taken when you request access.
