Security architecture

Security model

NexLens uses layered controls rather than relying on a single security mechanism. Access authentication, user-scoped database rules, private storage, authenticated service communication, and deletion controls work together.

Access and isolation

• Every user-data API route requires an authenticated user.
• Database queries are scoped by both record ID and authenticated user ID.
• Row-level access policies provide an additional database boundary.
• Private storage paths are not exposed as public asset URLs.

Storage and transmission

Contracts and playbook sources are held in private object storage. Managed encryption protects stored files and records, and HTTPS protects traffic in transit.

Private files are accessed through authenticated application routes or short-lived access mechanisms rather than permanent public links.

Private document processing

DOCX conversion, camera-image normalization, and OCR use Nexarra-controlled document-processing infrastructure. The service is exposed only through HTTPS, requires service authentication, uses request-scoped temporary files, and avoids content-bearing access logs.

Contract bytes are not sent to public file-conversion or OCR websites.

AI processing boundary

When you request analysis, relevant contract text and selected playbook content are sent to a specialized AI processing provider to generate the report. Customer content is not used to train models.

Shared responsibility

• Use a unique password and protect access to your email account.
• Do not share account credentials.
• Delete reports and playbooks when they are no longer required.
• Review exported files before sharing them outside your organization.
• Report suspected unauthorized access to support@getnexarra.com.