Security & trust
Trust you can check.
How we protect your data and keep AI systems under your control. Plain commitments, and no badges we have not earned.
Our commitments
Six promises behind every project.
Your data serves your project only
We use the data you share only to deliver the agreed work. We never use it to train models for anyone else, and we choose AI services and settings that do not use it to train theirs.
Least data, least access
Systems receive only the data a task needs. People and AI see only what their role allows, and our own access ends when the work does.
You decide where data lives
Before we build, we agree in writing where data is stored and processed: global services, cloud regions in Qatar, or your own infrastructure.
People approve what matters
AI can draft, suggest and prepare. Actions with real impact, such as sending, paying or changing records, wait for a person.
Everything is traceable
Answers cite their sources and agent actions are logged, so you can always see what happened, and why.
Honest about limits
We document how each system was tested, what it does not do well and what it costs to run. No black boxes, no inflated claims.
How we build it in
Security at every stage, not at the end.
- 01
Discovery
Data map and risk check
We map what data the use case needs, how sensitive it is and which rules apply, including Qatar's data protection law and any sector requirements, before design starts.
- 02
Design
Security in the architecture
Hosting chosen per class of data, access that mirrors your existing permissions, secrets kept out of code, and separate test and production environments.
- 03
Build
Safe by default
Encryption in transit and at rest using the platform's standard controls, least-privilege service accounts, and test data without real personal data wherever possible.
- 04
AI safeguards
Defences specific to AI
Retrieved documents are treated as data, never as instructions. Agents are limited to the tools and records their task needs, outputs are checked before they reach people or other systems, and every test set includes adversarial cases.
- 05
Handover
Operate, then hand over cleanly
Monitoring and alerts, an incident plan agreed with your team and full documentation. At the end, our access is removed and project data is returned or deleted, as you choose.
This website
What happens when you visit nexaurai.com
- Served only over HTTPS, with HSTS and a strict Content Security Policy.
- No tracking cookies, analytics or advertising tools. Fonts come from our own server.
- One small cookie remembers your language choice, and nothing else.
- The contact form is protected by an invisible check and rate limits, not by a third-party CAPTCHA that would track you.
Straight answers
Questions clients ask us.
Do you hold security certifications such as ISO 27001?
Not at this time, and we will not imply otherwise. We follow recognised guidance in our work, including the NIST AI Risk Management Framework and the National Cyber Security Agency's guidelines on secure AI, and we are glad to work within your security policies and complete your security questionnaire.
Will you use our data to train AI models?
No. Your data is used only for your project. Where we use external AI services, we choose services and settings that do not use your data for training, and we tell you which services are involved.
Who at Nexaurai can access our data?
Only the people working on your project, with access you grant and can revoke at any time. We prefer to work inside your environment, with your accounts and your logging, so you stay in control.
Can the whole system run on our own infrastructure?
Yes. Systems can run in your own cloud account, in a cloud region in Qatar, or on your own servers with private, open-weight models, so no data leaves your environment.
Can we agree confidentiality and data protection terms?
Yes. We are happy to agree confidentiality and data processing terms before any data is shared.
What happens to our data when the project ends?
We hand over the documentation, remove our access, and return or delete project data as you choose, then confirm it in writing.
Found a security issue?
If you believe you have found a vulnerability on this website or in a system we built, email us with “Security” in the subject. Please leave sensitive details out of the first message; we will reply and agree a safe way to share them, and ask that you give us reasonable time to fix the issue before sharing it publicly.
Report a security issueReady to put AI to work?
Tell us about the process you want to improve or the product you want to build. Every message is read and answered personally.