Security you can inspect, not slogans
This page describes controls that exist in the codebase. It is not a certification, a penetration-test report or a legal opinion.
Authentication
Email and password (bcrypt), Google OAuth with optional domain allowlist, and Microsoft Entra ID. Access JWTs are short-lived; refresh tokens rotate.
Layered roles
System administrators, business roles (ADMIN, MANAGER, MEMBER), workspace roles and per-file roles are combined. The intersection decides the action.
Section and tenant scope
Business records are filtered by the caller’s tenants. Hiding a button is never a substitute for the API guard.
Document access
Folder inheritance, explicit grants, public links with token, optional password and expiry. A share cannot expose what the sharer cannot see.
Audit and activity
Administrative audit is separate from the operational activity timeline. They are different stores for different readers.
Deployment choices
Cloud, private cloud or on-premise. Storage provider is configuration. Dual database users keep schema credentials off the runtime user.
Human confirmation for AI writes
When proposed actions are enabled, the assistant cannot silently change records. A person confirms.
What we do not claim
We do not state that NexusOS is GDPR certified, ISO certified, 100% secure, zero-risk or military-grade. Those phrases need evidence you will not find on a marketing page.
Quality and AI Act are product areas of their own. See the Quality and AI Act pages. Neither is a certificate for Cosmic Brokkoli or for NexusOS.
Your company does not need more disconnected tools.
Let’s identify the first process NexusOS can simplify.