Platform controls
The four engineering controls every Nexora deployment inherits, regardless of channel or tier.
Data handling
Three categories of data move through Nexora deployments. Here’s how each is handled.
Conversation data
Speech-to-text transcripts, language-model outputs, and synthesised audio. Retention is configurable per deployment — typically thirty days for transcripts and zero for raw audio. PCI, PII and health identifiers are detected and redacted in real time at the LLM boundary so they never enter long-term storage.
Customer data integrations
Nexora accesses your CRM, ticketing and billing systems via API keys you hold in your tenant. The access is read-only or scoped-write, configured per integration. We do not persist your customer-record data beyond what’s needed to complete the in-flight conversation.
Operational telemetry
Service health metrics, audit logs, and error traces. Stored in Nexora’s primary region (New Zealand by default; configurable). Retained for ninety days, then deleted.
Sub-processors
Nexora uses third-party services to deliver parts of the platform. Each is bound by a data-processing agreement. The list below covers the sub-processors that touch data on the marketing site and on every Nexora deployment.
| Provider | Purpose | Data category | Region |
|---|---|---|---|
| Anthropic | Language-model inference (Claude models) | Conversation inputs and outputs sent for inference | Region per deployment |
| OpenAI | Language-model inference (GPT models) | Conversation inputs and outputs sent for inference | Region per deployment |
| Cloudflare Turnstile | Bot protection on marketing-site forms | Turnstile token only — no personal data | Global edge |
| Google (Google Analytics 4) | Marketing-site analytics: page views and CTA event tracking | Pseudonymous client ID, anonymised IP, page URL, device and browser type, country | Google's regional data centres (EU/US per visitor) |
| Transactional-email provider | Replies to form submissions on this site | Submitter email and name | Provider's region |
Cloud and telephony providers vary by deployment region and customer security requirements. We list those for your specific deployment in our security-questionnaire response — not on this public page — so each customer sees the actual stack their data touches.
Engage our security team
Two ways to talk to us about security.
Security questionnaire
We respond to standard security questionnaires (CAIQ, SIG, custom) typically within five business days. Use the contact form, choose “security” as the topic, and attach the questionnaire — we route it straight to our security lead.
Data Processing Addendum (DPA)
Our DPA, drafted to NZ Privacy Act 2020 and GDPR standards, is available on request. We’re also comfortable signing customer DPAs — bring yours and we’ll typically review and reply within five business days.
Data residency
New Zealand is the default deployment region. We support Australia, the United States, the United Kingdom and the European Union on request. Cross-region replication is opt-in — never on by default — and is configured per customer in the deployment plan.
Last updated: 13 May 2026 · Version v1
When sub-processors, retention defaults, or posture change, we update this page and bump the version. The most recent version is always at /security.