Skip to main content

NEXUS AI PLATFORM / SECURITY & DATA

Closed by default. Your data, your model, your boundary.

Four claims, stated plainly. Each one is checkable in a technical session without us describing how it is enforced. This is the page to forward to whoever reviews security where you work.

Book a technical session

Data stays inside your infrastructure

Information is confined within your own environment, and the platform runs isolated from the production GIS. Nothing is copied out in order to run it.

Encrypted end to end

All communication uses end-to-end encryption — with the third-party systems the platform connects to, and with the model alike.

Closed by default

No external access is required, and none is permitted. External connectivity exists only where you specifically ask for it, which makes the restrictive posture the default rather than the hardened option.

The model runs where you do

The model backend runs on premises or in your own cloud by default. A managed cloud model is opt-in only, and with the in-boundary model prompts and document content never leave your network.

A single installation serves several operating units — each with its own environment, its own controls and its own access. Administrators manage them side by side, and access and visibility are set per organisation rather than once, globally. Someone working in one does not see another unless that is granted.

The organisations screen in Nexus: twelve distribution networks listed with their slug, display name and access setting, one of them marked active, beside a sidebar whose sections include Organizations, Clients, Admins, Integrations and Audit.
Twelve organisations in a MagikDev demonstration environment. Access is set for each one separately, and an administrator works inside a single organisation at a time.

A profile is not checked once at the door. It is applied at the platform, inside each pod, on the map, and in query responses.

  1. At the platform

    Whether someone can reach Nexus at all, which is settled before any question of what they might do once they are inside.

  2. Inside each pod

    What a profile may do within a given pod, which is a different question from whether they can open it.

  3. On the map

    Which layers a profile is shown, so two people can open the same map and not be looking at the same thing.

  4. In query responses

    What a plain-language answer is allowed to contain. This is the one that gets forgotten: a layer hidden on a map is worth little if a question can read it back out in prose.

Who people are, and who else can see it

Users authenticate against your corporate directory. People outside your organisation work under the same access model rather than a parallel one, and links shared with them expire rather than circulating indefinitely.

What was done, how, and by whom

The platform writes the audit trail at the same moment it writes to the system of record — not afterwards on a schedule, and not as a separate reconciliation somebody has to run. What was done, how it was done and who did it travel with the change itself.

The Nexus audit trail: a table of timestamped events, each with the time it happened, the actor who caused it and the action taken — a job server start request, a dashboard schedule run, a dashboard revision restored.
The audit trail as it appears in the platform, running in a MagikDev environment rather than a customer’s. The actors are display names from our own demonstration data.

  • We are not claiming certification against any standard here. If your review needs evidence against a particular one, bring it to the session and we will answer against it directly.
  • Nor is there a service-level commitment on this page. That belongs in an agreement you can hold us to, which is a different document from this one.
  • What is set out above is what the platform holds to. How each of those four properties is actually enforced is something we go through under NDA, after the live session.

A technical session answers the questions this page deliberately stops short of.

Book a technical session