Security atNanexi.

Nanexi uses a layered security approach designed to reduce risks across accounts, uploaded content, application workflows, infrastructure, and operational access.

Security is an ongoing process. We may update controls as the product, infrastructure, threats, and customer requirements evolve.

No online service can guarantee absolute security, but we aim to apply reasonable technical and organizational measures appropriate to the service.

Nanexi uses authenticated user accounts to control access to private application features.

Account-related protections may include:

• Email verification where applicable.
• Password-based authentication controls.
• Password-reset mechanisms.
• Protected authenticated routes.
• Session and authorization checks.
• Rate limiting for login and authentication-related actions.

Users are responsible for maintaining the confidentiality of their credentials and should not share passwords or account access unnecessarily.

Authenticated access alone does not automatically grant access to every resource.

Nanexi application workflows are designed to check whether a user is permitted to access relevant organizations, RFP projects, documents, billing information, knowledge, and other protected resources.

Administrative or organization-level capabilities may be limited according to applicable account permissions and application logic.

RFP documents and knowledge-base files may contain confidential business information. Nanexi is designed to process uploaded files through private application workflows rather than treating them as public website content.

File-handling controls may include:

• Supported document-type validation.
• MIME-type checks.
• File-size limits.
• Randomized file or storage identifiers.
• Private storage configuration.
• Authorization checks before protected document access.

Users should only upload documents they are authorized to process through Nanexi.

Nanexi applies rate limits to selected sensitive operations to help reduce automated abuse, credential attacks, excessive requests, and misuse of resource-intensive functions.

Rate-limited operations may include authentication flows, file uploads, and AI-related actions.

Limits may change over time based on security, infrastructure, and product requirements.

Nanexi uses managed database infrastructure for application data.

Database access is intended to be limited to authorized application and operational workflows. Credentials and connection information should not be exposed publicly.

Application-level authorization remains important even when data is stored in managed database infrastructure.

Sensitive application configuration such as database credentials, payment secrets, API credentials, webhook secrets, and other confidential configuration should be stored in protected environment variables or equivalent secret-management systems.

Sensitive production credentials should not be committed to public source-code repositories or exposed in client-side code.

Nanexi may use third-party payment providers to process paid subscriptions.

Payment-card or banking information may be collected and handled directly by the payment provider rather than stored directly by Nanexi.

Nanexi may receive payment-related information such as subscription identifiers, transaction references, payment status, plan information, and billing events needed to manage the subscription.

Payment provider security and compliance practices are governed by the provider's own systems, terms, and policies.

Nanexi may process RFP requirements and approved organizational knowledge using AI-enabled systems.

AI-generated responses are drafts and should not be treated as automatically correct or approved.

Nanexi is designed around a workflow where retrieved evidence can support response generation and human reviewers retain control over final approval.

Users remain responsible for verifying generated content before using it in an RFP submission or other business decision.

A core Nanexi design principle is to use relevant approved organizational knowledge when assisting with RFP responses rather than relying only on general AI model knowledge.

This approach can help teams inspect supporting evidence and maintain greater control over the factual basis of generated content.

Grounding does not eliminate the need for human verification.

Nanexi relies on third-party infrastructure and technology providers to operate parts of the service.

These providers may support areas such as:

• Application hosting.
• Database infrastructure.
• File storage.
• Email delivery.
• Payment processing.
• AI processing.
• Logging and monitoring.
• Security and operational services.

Provider selection and configuration may change as the product evolves.

Nanexi may maintain application, operational, authentication, billing, error, and security logs as reasonably necessary to operate and protect the service.

Logs may be used for purposes such as:

• Diagnosing application failures.
• Investigating security events.
• Detecting suspicious activity.
• Enforcing usage limits.
• Supporting billing and subscription workflows.
• Improving reliability and performance.

Nanexi may perform security reviews, dependency updates, application testing, configuration reviews, and other maintenance designed to reduce known risks.

Software dependencies and infrastructure may be updated as new security fixes or product versions become available.

Data may be retained for as long as reasonably necessary to provide the service, maintain account and billing functionality, meet legitimate operational requirements, protect security, and comply with applicable law.

Some data may remain temporarily in backups, logs, or recovery systems after deletion from active application storage.

For additional information, review the Privacy Policy.

Security is shared between Nanexi and its users.

Users and organizations should:

• Protect account passwords and authentication credentials.
• Use secure devices and networks.
• Remove access for people who no longer require it.
• Avoid sharing sensitive credentials through RFP documents or support messages.
• Review the sensitivity and authorization status of documents before uploading them.
• Verify AI-generated answers before approval or submission.
• Report suspected unauthorized account access promptly.

If Nanexi becomes aware of a security incident affecting the confidentiality, integrity, or availability of information, we may investigate, contain, remediate, and document the event as appropriate.

Where legally required, affected users or relevant authorities may be notified according to applicable requirements.

If you believe you have discovered a security vulnerability in Nanexi, please report it responsibly rather than exploiting, publicly disclosing, or using the issue to access information without authorization.

Include enough technical detail for us to understand and reproduce the issue where reasonably possible.

Do not include unnecessary personal information, passwords, payment credentials, or confidential third-party information in a vulnerability report.

Unless explicitly stated in a current Nanexi agreement or public statement, this page should not be interpreted as a claim that Nanexi holds a specific security certification or formal compliance attestation.

We will only claim standards, certifications, audits, or attestations that have actually been completed and remain applicable.

To report a potential security issue or ask a security-related question, contact: