Security & Data Handling
What Aegis stores, how access is controlled, and where we are on our own compliance journey, stated plainly for the security team evaluating us.
For the security team evaluating Aegis. Aegis is a compliance product, so it holds the security of your program to the same standard it helps you hold everything else to. Below is how it treats your data and access, and, in the same spirit as the rest of this platform, what we have not built yet.
The short version
- Your program data is scoped to your organization. Every query is organization-scoped; one tenant cannot see another's controls, policies, evidence or risks.
- Access is least-privilege by default. Role-based access with a granular
resource:actionpermission model, enforced server-side, not just hidden in the UI. - Auditors get a read-only room. The auditor role can review everything needed to form an opinion and change nothing.
- AI output is a draft for a human. Generated policies, risk mappings and questionnaire answers are reviewed and approved by an owner before they count or leave the building.
- We report honestly. An unaddressed control is shown as such, never as "pass"; a check that cannot run reports not-determined.
Access & tenancy
| Control | How it works |
|---|---|
| Tenant isolation | Program data is organization-scoped on every read and write |
| Authentication | Per-user sessions via a dedicated identity provider; no long-lived tokens in the browser |
| Authorization | Default-deny, role-based, resolved from the database, with a granular resource:action matrix checked on every customer-facing action |
| Roles | Owner, admin, auditor (read-only), employee, contractor, plus custom roles |
| API keys | Stored hashed, never in plaintext |
| In transit | TLS to all endpoints |
| At rest | Encrypted by the cloud provider |
How AI is used
Aegis uses large language models to do the drafting and assessment work, materializing your program, writing policies, mapping risks to controls, and answering questionnaires.
- AI produces drafts, not decisions. Everything an AI generates is reviewed and approved by a human owner before it is published, attested, or sent to a customer.
- It works from your program. Questionnaire answers and policies are grounded in your own policies and organization details, not invented.
- It does not manufacture evidence. AI never marks a control as met on its own; a control needs real evidence to move.
- Uploaded documents are suggestions, not writes. Documents in the Document Vault are text-extracted and analysed by a language model, with the document text passed as material to analyse, separate from the model's instructions. Every suggestion must quote the document, and nothing is applied until a person approves it. Deleting a document removes the file and its extracted text.
- Agents propose, people decide. An AI assistant connected over MCP can propose assessment answers, but they are held until a person confirms them, and every call is logged.
If your policy places specific constraints on how organizational data may be processed by AI providers, raise it early. We would rather scope the engagement to your requirements up front than discover the constraint mid-procurement.
Data you control
- You decide what is public. The Trust Center shows only what you choose; sensitive documents sit behind access requests and NDA gating.
- Integrations are read-oriented and scoped. You connect the systems you want, for the evidence you want, and can disconnect them.
- The device agent reports posture, not content. It evidences whether controls hold on a device; it is an endpoint-compliance signal, not a surveillance tool.
What we do not have yet
Stated because you will ask, and because discovering it mid-procurement is worse for both of us. There is an irony we are comfortable with: Aegis helps you get certified while NexusVoid is still early on its own journey.
| Gap | Where that leaves you |
|---|---|
| No NexusVoid SOC 2 report yet | We can walk your team through our architecture and controls, but we cannot hand you our own attestation today. |
| No NexusVoid ISO 27001 yet | Same. |
| No customer-managed encryption keys | Data is encrypted at rest under cloud-provider-managed keys. |
If any of these is a hard requirement, tell us early so we can be straight with you about timing.
Questions we expect
"Can one customer see another's data?" No. Program data is organization-scoped on every access; isolation is enforced in the data layer, not left to each screen.
"What can your staff see?" Operators with production database access can see program data as with any hosted service; there is a clear separation between that and what a normal user or auditor can reach through the product.
"If we leave, what happens to our data?" Tell us and we remove your organization's data. We will document the specifics as part of any engagement.
"How do we know a control is really met?" Because Aegis will not say it is without evidence. Unaddressed controls read as unaddressed, and checks that could not run read as not-determined, never as a pass.
Prepared by NexusVoid. Ask us to demonstrate any claim in this document, or request the current security package for the detail your review needs.