Security & privacy: clear data flows for your knowledge.

Security is not a feature. It is our architecture.

Data protection and information security have been built into the Nexoria platform from the outset. The specific measures are set out in the following sections.

As of: 30.09.2026

Architecture at a glance

Infrastructure & hosting

• Dedicated servers in German data centres, no shared hosting environments
• File storage, the knowledge index and semantic search are operated on dedicated servers in Germany
• Own mail server, independent of Microsoft 365 or Google Workspace. If a customer connects an existing Microsoft or Google inbox, this connection runs via their Graph API or Gmail API respectively, see the processing table above
• Encrypted connections between all server components
• Continuous patch management and security updates

Tenant separation at database level

• Separate database schemas per tenant with separation at infrastructure level
• Individual vector data spaces per tenant for AI search
• Cryptographically signed access tokens prevent cross-tenant access
• Errors in the application logic cannot expose data belonging to other tenants

Encryption at four levels

• Transport encryption on all client and server connections
• Symmetric encryption of sensitive configuration data at rest
• Password hashing with BSI-recommended memory- and time-intensive methods
• Backup encryption with asymmetric key exchange and authenticated symmetric encryption

Access control

• Two-tier role model: tenant roles and workspace roles
• Principle of least privilege as standard
• Multi-factor authentication available and recommended for administrators
• Server-side permission checks on every API endpoint

Audit & traceability

• Complete, immutable audit trail of all security-relevant actions
• Logging covers authentication, data access, changes, administration, external communication
• Append-only storage, kept separate from application data, prevents subsequent tampering
• Supports you in providing evidence, for example for the accountability obligation under Art. 5(2) GDPR. Audit logs are retained for 12 months.

AI processing & data minimisation

• Document embeddings and semantic search run on servers in Germany, using models that Nexoria operates there itself.
• Search expansion (query expansion, HyDE) and relevance scoring also run on servers in Germany, using models that Nexoria operates there itself.
• Internet search uses our own infrastructure, hosted in Germany
• Answer generation uses Mistral AI
• Other services and enabled integrations have their own data flows; the processing table and the processing register assign them to the providers involved
• In Nexoria’s verified Mistral organisation, the use of new API interactions for model training is disabled (account checked on 26 September 2026). This setting applies to new interactions processed there. For your own optionally connected AI accounts, the settings of the respective account apply. Training use and retention are separate questions; the setting mentioned is not a commitment to any particular retention period.
• External AI integrations: ChatGPT (OpenAI), Claude (Anthropic), Gemini (Google) and Langdock can optionally be connected to Nexoria. Nexoria also works without these integrations. When connected, shared content is transferred to the respective provider. That provider's terms, processing locations and settings apply.
• Nexoria Meet (Mail and Meet add-on): live transcription in Nexoria Meet is performed with Mistral.
• The service providers used are named in the processing register under Art. 30 . The processing table above shows which data the respective providers receive
• VoiceBot: Telnyx LLC / Telnyx Ireland Limited (headquarters USA, EU branch Ireland) provides the telephone connection only with an active VoiceBot subscription. The telephone connection via Telnyx is located in Frankfurt. Speech recognition (STT) and speech synthesis (TTS) are performed via Voxtral from Mistral AI. The LLM responses are generated by Mistral AI. For Telnyx, standard contractual clauses under Art. 46(2)(c) GDPR and a data processing agreement apply

This page describes how the platform is built, and it is also the answer to the preliminary question of the conditions under which AI can be used in-house in compliance with data protection law: processing location, subprocessors involved, data processing agreement, training use and third-country transfers are each set out further below with a source. The questions asked most frequently in procurement and data protection reviews are also answered on the page answers for evaluation. How an answer is produced technically, from the file in Nexoria Drive through the index and document search to Nex's answer with source citation, can be found under Enterprise Search: searching documents semantically. The sequence of steps involved, from filing through indexing and permission checks to the answer with its source, is described in Company knowledge: making scattered files usable. If a question that your data protection review needs answered is still open after that, ask it via the contact form, and it goes directly to the founders.

Incident response

• Continuous 24/7 monitoring of all production systems
• Documented incident response process for security incidents
• Notification of personal data breaches to affected tenants without undue delay, at the latest within 24 hours of becoming aware (DPA § 5(6)), as the basis for your assessment under Art. 33 GDPR
• For processing for which Nexoria itself is responsible: notification to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware (Art. 33(1) GDPR)

Backup & business continuity

• Daily automated, encrypted backups of all production databases
• Cross-server replication for resilience
• Documented and regularly tested recovery procedures
• Target availability: 99.5% as an annual average

Data deletion after termination

• 30-day export window after termination with full functionality
• After that, documents, vectors, chat histories, configurations and user accounts are deleted. Backups of tenant-specific data are deleted once the backup rotation has expired.
• Separate period for Nexoria Meet: after the end of the contract, recordings and transcripts from Nexoria Meet are retained for 180 days by default. The period can be adjusted individually. Separately, there is a period of 30 days after the end of the contract during which customers can request the export of their data under the general terms.
• Deletion covers tenant databases, vector embeddings, files, chat histories and connector configurations; we confirm it in writing on request.
• Supports you with erasure requests under Art. 17 GDPR, including for individual persons in recordings from Nexoria Meet.

Compliance & standards

• The technical and organisational measures are based on BSI IT-Grundschutz and have been implemented, specifically following the modules ORP.4, CON.1, APP.5.3 and OPS.1.1.5. This does not replace a certificate. Certification requires an external audit, and no such procedure has currently been commissioned or scheduled.
• Data protection by default: transcription in Nexoria Meet is disabled by default for each tenant and is only enabled by an administrator of the customer. The data processing agreement under Art. 28 GDPR is publicly available; the technical and organisational measures under Art. 32 are set out in § 6 of that agreement.
• EU AI Act: security-relevant actions are logged in the audit trail and retained for 12 months. Which obligations under Regulation (EU) 2024/1689 apply to your use depends on the classification of your use case.
• Public data protection documents: privacy policy and Data processing agreement.

Frequently asked questions

Who has access to my data?

Only users you authorise within your organisation. No Nexoria employee can access your business data without your express permission. Support access is logged and requires your consent.

What happens to my data when an employee leaves the company?

Administrators can deactivate or delete user accounts immediately. Deactivation preserves the audit history while revoking access. Deletion removes the user's personal data; business data created by the user remains under your control.

How is a security incident handled?

Continuous monitoring triggers a documented incident response process: containment, analysis and notification of affected tenants without undue delay and at the latest within 24 hours of becoming aware. On this basis, you, as the controller, assess the notification to the supervisory authority under Art. 33 GDPR.

Do you use my data to train your AI?

In Nexoria’s verified Mistral organisation, the use of new API interactions for model training is disabled (account checked on 26 September 2026). This setting applies to new interactions processed there. For your own optionally connected AI accounts, the settings of the respective account apply. Training use and retention are separate questions; the setting mentioned is not a commitment to any particular retention period.

Where are your servers located?

Files, the knowledge index and semantic search run on dedicated servers in Germany. Answer generation by Nex uses Mistral AI. Technical error monitoring, payment processing and enabled add-on services need to be considered separately. These include Sentry and, when the email integration is enabled, Microsoft Graph and Gmail. The same applies to optionally connected external AI providers such as ChatGPT, Claude, Gemini and Langdock. When connected, shared content is transferred to the respective provider. That provider's terms, processing locations and settings apply. The components and providers involved are listed under Security and privacy and in the Processing register .

What security documentation does Nexoria provide?

The security overview describes the technical and organisational measures, data processing and the service providers used. The documentation supports your internal review and the preparation of a joint introductory meeting.

Detailed security documentation

A comprehensive security white paper is available on request for qualified enterprise customers, with technical and organisational measures, an architecture overview, an incident response playbook and security baseline mappings. Requests can be made via the contact form or by email to security@nexoria-systems.de.

Security consultation: your questions about the architecture

In a 30-minute consultation, we show how our architecture addresses GDPR and compliance requirements, with direct access to the CTO.

Costs of use are listed on Pricing, the components of the platform can be found under Product. You can arrange an appointment via Contact.

---

Sources

The statements on this page that rely on laws, norms, standards or third parties are based on the following publicly available sources. All addresses were accessed on 21 August 2026.

• Regulation (EU) 2016/679 (GDPR): full text in the Official Journal of the European Union, OJ L 119 of 4 May 2016, p. 1. Authoritative for Articles 5(2), 17, 25, 28, 30, 32, 33 and 35 mentioned on this page, including the 72-hour deadline under Art. 33(1) and the data protection impact assessment under Art. 35. eur-lex.europa.eu/eli/reg/2016/679/oj
• Regulation (EU) 2024/1689 (Artificial Intelligence Act, EU AI Act): Regulation of 13 June 2024, published in the Official Journal on 12 July 2024, reference OJ L, 2024/1689. Basis for the note on the EU AI Act and on the classification of use cases. eur-lex.europa.eu/eli/reg/2024/1689/oj
• Commission Implementing Decision (EU) 2021/914 of 4 June 2021: standard contractual clauses for the transfer of personal data to third countries under the GDPR, OJ L 199 of 7 June 2021, p. 31. Establishes what is meant by the standard contractual clauses mentioned on this page. The clauses alone do not establish the lawfulness of a specific transfer; a transfer impact assessment is also required for that. eur-lex.europa.eu/eli/dec_impl/2021/914/oj
• BSI IT-Grundschutz: the official presentation by the Federal Office for Information Security. Reference point for the statement that the technical and organisational measures are aligned with IT-Grundschutz. www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/St...
• BSI TR-02102-1, Cryptographic Mechanisms: Recommendations and Key Lengths, version 2026-01: part 1 of the four-part Technical Guideline TR-02102. Reference point for the cryptographic mechanisms and key lengths used. The guideline evaluates selected mechanisms and, by its own account, makes no claim to completeness. www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/St...
• Mistral AI, Legal Notice: states the legal form (simplified joint-stock company), the commercial register entry in Paris (R.C.S. 952 418 325) and the registered office at 15 Rue des Halles, 75001 Paris, France. Basis for the statement "Mistral AI (Paris, EU)". legal.mistral.ai/legal-notice
• Mistral AI, homepage: regarding use via the Mistral APIs, it states that the servers are operated in the EU. mistral.ai
• Sentry, privacy policy: names Functional Software, Inc. d/b/a Sentry, 45 Fremont Street, 8th Floor, San Francisco, CA 94105, as the controller. The same policy names Sentry Software Netherlands B.V., Schiphol Boulevard 359, 1118 BJ Amsterdam Schiphol, as its EU representative and refers to its participation in the EU-U.S. Data Privacy Framework. sentry.io/privacy

Citations of laws and standards establish the content of the respective provision, not Nexoria's compliance with it. Statements on Nexoria's own architecture, operating processes and availability targets are self-reported by Nexoria Systems UG (haftungsbeschränkt) and have not been externally audited to date. Sentry is a registered trademark of Functional Software, Inc., and Mistral AI is the company name of the Paris-based provider. These names are mentioned solely for factual context.