Evidence you can verify — not assurances.
Automate with confidence. The board's question is exposure: what a worker can do, who answers for it and what proves it. Before any Nxgyle worker reaches production, your risk and security leaders can read its blueprint, see it validated on synthetic data and, optionally, red-team it. This page sets out the evidence we provide and what we do not yet claim.
European privacy law
Privacy law, California
Network traffic and stored data
Human approval steps
Security and availability controls
First on the roadmap — target date: being finalized.
Information-security management
Management system for AI
Accessibility of our interfaces
“In place” means the control is operating today. “Roadmap” means a formal third-party certification in progress. We never claim a certification before it is awarded. Contact security@nxgyle.com for current status and documentation.
Some status chips read Roadmap. That is deliberate. We publish what is true today, not what we expect to achieve, and we label claims across this site the same way.
SOC 2 Type II — target date: being finalized.
Until those certifications are awarded, your assurance rests on the following.
- The software runs on your infrastructure, inside the compliance controls you already operate.
- Your auditors can review the audit-trail specification.
- Your security team can review sanitized sample export files on request.
Security evidence in every delivery.
Each delivery carries its own security analysis, so your CISO reviews evidence, not assurances. The controls below govern the platform we operate.
- Encrypted traffic and stored data
- Role-based access for the Studio, its tenants and workspaces
- A STRIDE threat model and data-flow diagram in every export
- Platform monitoring, logging and a defined incident-response process
- A responsible-disclosure channel for reporting vulnerabilities
Your data stays in your control.
Workers are designed and validated in the Studio, entirely on synthetic data if you choose, so evaluation requires no production data. In production, the software runs on your infrastructure, with no Nxgyle cloud involved.
- Validation can run entirely on synthetic data; no production data is needed to design or evaluate a worker
- Delivered software runs on your own infrastructure
- Data residency within our Herndon, VA and Hyderabad, India operations
- GDPR and CCPA data-handling practices, with retention and deletion on request
- Sub-processor list available on request
Automation you can explain and defend.
For an AI provider, governance is a core obligation, not fine print. The Foundation is designed to make every automated decision explainable and accountable.
- A readable blueprint for every worker, never “the model decided”
- Stated business rules run as deterministic checks wherever possible: the same inputs, the same verdict
- Approval steps that hold the worker until an accountable person decides
- Every approval recorded, with an optional tamper-evident run log; specification available to auditors
- Optional personal-data redaction at tool calls, off by default
Four mechanisms your auditors can verify.
Every claim on this site rests on one of these mechanisms. Each can be checked independently: in a live session, in documentation your auditors request, or in the trace each test run records. None of it depends on trusting our word.
Rehearsal before reality
The Studio generates realistic synthetic data for each worker's processes, so every worker is exercised on production-like cases before it touches a live system. Run it step by step or end to end, and watch each approval step pause the run until a reviewer answers. Several workers can run together on a simulated clock to expose contention between them. The optional red-team module tests a worker against known attack techniques. Because no production data is involved, your security team can approve an evaluation from a written process description, without a data-sharing agreement.
How rehearsal worksRules you can rely on
The AI analyst converts the business rules you state into deterministic checks wherever it can, and flags any rule it could not encode. A deterministic check never calls an AI model, so the same inputs always produce the same verdict. Routine decisions that no one has written down belong to Nxgyle's Cognitive Engine. It runs as its own product, accessed through the Cognitive Studio's decision API rather than built into Nx·Studio workers. It learns from confirmed outcomes and acts only after passing an exam on cases it has never seen.
Visit the Cognitive EngineBlueprints you can read
Every digital worker is a versioned blueprint, not an opaque chain of prompts. It shows what the worker does, who approves what and where cases are routed to people. Every save becomes a version you can compare, branch or merge. Business owners read it as swimlanes by team, role and system, and the Studio summarizes exactly what was built. Like everything the platform generates, the blueprint is yours.
Read the governance modelProof in every export
Every export includes a signed bill of materials: an inventory of every software and AI component, with a signed attestation over every exported file. Your security team verifies it offline with the included verifier. The export also contains a STRIDE threat model and a machine-readable EU AI Act documentation template, and the Studio issues an itemized ownership report. The worker runs without us: no Nxgyle runtime, no license check, no metering and no calls home. “No lock-in” becomes something you can verify.
See the export evidenceVerify the evidence on your own hardware.
Every export carries evidence you can check independently: a signed bill of materials listing every software and AI component. Your security team verifies it offline, on your own hardware, with no connection to us. The Studio adds an itemized ownership report, and a sanitized sample is available on request. The conclusion is yours to draw.
The worker is engineered to run without us: no Nxgyle runtime, no license check, no metering and no calls home.
Rules are demonstrated, not asserted. In any live session, have us run the same case twice and confirm that your stated rules return the same answer.
- Signed bill of materials Every software and AI component, with a verifier that runs offlineships inside
- Threat model A STRIDE threat model with a data-flow diagramships inside
- EU AI Act cross-reference Maps the Act's documentation items to the bill of materials; it is not a conformity assessmentships inside
- Ownership report An itemized inventory of everything delivered, with a PDF summaryStudio output
Verified on your hardware. The conclusion is yours to draw.
Auditors review what a worker will do before it runs.
Governance here is not a dashboard over a black box. It is a set of documents your teams can read, compare version by version and retain.
One blueprint, three audiences
Every worker is a readable, versioned blueprint that sets out its agents and roles, connections, approval steps, routing and decision rules. Nothing is buried in prompts or locked in a vendor’s runtime. Engineers version and compare it like code, governance teams review it before deployment, and auditors test against it afterwards.
Approval records and lineage
Every approval is recorded on an audit trail: who approved what, and when. A tamper-evident run log and field-level data lineage (the origin of each data field) are optional and off by default. Rules encoded as deterministic checks always return the same verdict for the same inputs.
Approvals run in code you own
Approval steps pause the worker until a person answers. Each export with approval steps includes a reviewer inbox app, which your engineers connect to the worker; Slack notifications are optional. A requester can never approve their own request. All of it ships as code you own, so your approval policy lives in your software, not on our servers.
How the data you choose to share is governed.
Each worker can have realistic synthetic data generated for its own processes, so test runs, simulations and red-team exercises need no production data. If you upload sample data instead, it stays within your workspace, accessible only to its members.
Material shared during design follows a separate, governed path. You may share documents, process logs or sample data so your workers reflect your real volumes. You decide what is shared, it is used only to design your workers, and a data-processing agreement is signed before anything moves.
An evaluation built from your written process description shares no production data, only the description.
What is deterministic, what is not, and who decides.
Live AI judgment is not guaranteed to repeat.
That is why your stated rules never depend on it. Wherever possible, they run as deterministic checks inside the worker and return the same answer every time. Each test run's trace confirms it. Routine decisions that no one has written down belong to our Cognitive Engine, which is reached through the Cognitive Studio's decision API rather than built into Nx·Studio workers. It learns from confirmed outcomes and acts only after passing an exam on cases it has never seen.
Where AI judgment is required, a quality check can score each answer. You set the minimum score and what a low score triggers: a flag, a stopped run, or a different path, such as review by a person. By default it only flags. Approval steps hold the worker until a person decides.
Routing to a person is a control you set.
Evidence your auditors can request.
Each artifact below is sanitized and shared on request. Write to security@nxgyle.com.
Blueprint excerpt, sanitized
The swimlane view and export summary of a sample worker, so your governance team can see what a worker will do before it acts.
Evaluation report from a test run
Produced from a validation run on synthetic data, for your risk committee and procurement reviews.
A miniature export, sanitized
The file structure, README and test suite of a sample export. It shows the engineering standard of what you receive.
Redacted security analysis
The scope of the threat model in every export, with configuration details removed.
Specification of the audit trail
The events the audit trail records, and how the optional tamper-evident log exposes any later change.
Itemized ownership report (sample)
The itemized inventory, signed bill of materials and verifier output from a sample export. The conclusion is yours to draw.
Your auditors can review what each worker will do before it acts.
Precise pledges. Verifiable by design.
Each is one sentence, limited to what the platform can prove. A specific commitment you can verify is worth more than a broad one you cannot.
No production data is required to design or validate a worker.
No Nxgyle runtime in production, no per-decision charge and no reporting to us.
Your workers keep running if our engagement ends.
Every number on this site states how it was measured. If we cannot yet measure something honestly, we do not publish it.
The rule applies to third-party figures too: we quote them only with their source and date. Our delivery counts carry a note on how they were counted and are re-checked before each publication. If a figure can no longer be reproduced, it is removed from the entire site.
Operational resilience
Because the software runs on your infrastructure, availability is governed by your service-level agreements rather than ours. Our platform is continuously monitored under a defined incident-response process. A public status page for Nxgyle services is on our roadmap.
Reach the right team
- Security and vulnerability reports security@nxgyle.com
- Personal-data requests privacy@nxgyle.com
- Accessibility requests accessibility@nxgyle.com