The boring parts. Documented.

NexliOne is built around the assumption that you do not implicitly trust the network — every request between modules is authenticated, every action is authorized against a shared identity service, and every piece of data is encrypted by default. There is no "internal" surface.

AES-256 encryption at rest for every module's primary database, object store, and backup. TLS 1.3 in transit, with HSTS and certificate pinning on managed deployments. Customer-managed keys (KMS) supported on cloud and self-host editions.

Single sign-on via SAML 2.0 or OpenID Connect with any major identity provider. SCIM provisioning for automated user lifecycle. Multi-factor authentication enforceable at the IdP layer or natively if no IdP is in place.

Permissions are evaluated per-module, per-record, and per-field. Roles compose: a "Plant Manager" role can read everything inside their plant but nothing outside it. Attribute-based rules let you express constraints like "approvers must be different from authors."

Every read, every write, every admin action is recorded to an append-only audit log. Each entry is hash-chained to the previous entry — modifications break the chain and are detectable. Export to your SIEM via syslog, CEF, or JSON.

Self-hosted edition ships with full feature parity. Air-gapped installation supports environments without inbound or outbound internet. Updates ship as signed bundles you import on your schedule.

Choose where the data lives. Cloud edition runs in your selected region (US-East, US-West, EU-Central, CA-Central, AP-Southeast). Self-host puts the data wherever your infrastructure is. Cross-border data transfer is opt-in, never default.

NexliOne is designed against the controls in SOC 2 Type II, ISO 27001, HIPAA, and GDPR — and the platform ships the technical capabilities those frameworks require. Certification programs are progressing; we will publish reports as they are issued. We do not claim what is not yet certified.

Cloud edition: continuous database snapshots, point-in-time recovery to any moment in the last 35 days, cross-region replicated backups. Self-host edition: scripts for nightly snapshots, on-demand snapshots before upgrades, and tested restore procedures.