We only ship what survives our own attacks.
Before a Nexgile digital worker goes live, you can read its blueprint: the written plan of what it does. Its behavior is tested in practice runs on the Simulated Enterprise. And it is attacked with the techniques attackers will use. This page shows how we prove it, and what we haven’t earned the right to claim yet.
EU data protection
California privacy
In transit & at rest
Oversight & approvals
Security & availability
Top of the roadmap — target date: being finalized.
Information security
AI management system
Accessibility conformance
“In place” means controls and protections that are active today. “Roadmap” marks formal third-party certifications we are actively pursuing. We do not claim a certification before it is awarded. Contact security@nexgile.com for current status and documentation.
You’ll notice some labels say Roadmap. That’s deliberate. We publish what’s true, not what we are aiming for. Every claim on this site is labeled the way we label these. Top of the roadmap: SOC 2 Type II — target date: being finalized. While certifications are in progress, here’s what we offer today instead: self-hosting inside your existing compliance boundary, the audit-trail specification, and sanitized delivery files your security team can review on request.
Security is built into every delivery.
The software Nexgile generates comes with security built in. Our own platform is run to enterprise standards.
- Encryption in transit and at rest; the delivered software runs under keys and secrets you hold
- Identity and access controls with least-privilege by default
- An automatic security review delivered with every project
- Continuous monitoring, logging and a defined incident-response process
- Responsible-disclosure program for reporting vulnerabilities
Your data stays yours.
Nexgile is a studio for designing workers. They do practice runs on the Simulated Enterprise, which is sample data generated for each worker, so no production data is required to evaluate them. After delivery, you self-host. There is no Nexgile cloud in the middle.
- Practice runs need no production data; previews and simulations run on generated sample data
- You self-host the delivered software on your own infrastructure
- Data residency across our Herndon, VA and Hyderabad, India operations
- GDPR and CCPA aligned; retention and deletion on request
- Sub-processor transparency available on request
AI you can explain and defend.
For an agentic-AI company, governance is a core concern, not fine print. Our foundation is built to make automated decisions accountable.
- Decisions you can explain and repeat, not “the model decided”
- Routine work is deterministic: the same input gives the same result on every run
- Human approvals, escalation and override at any time
- Tamper-evident audit trails, included in a delivery when you ask, with a specification available to your auditors
- Training-data isolation and prompt-data deletion controls
Four safeguards, built to be checked.
Every claim on this site rests on one of these. You can check each one yourself: in a live session, in a record your auditors request, or in a replay. You are not asked to take it on faith.
The Simulated Enterprise
Every worker gets a place to practice: realistic sample data generated to fit it, a live preview that runs the real software, and a simulation lab. Digital workers practice real work there before they touch a live system. Play weeks of business activity in minutes, cause failures on purpose, and re-run any change against the same scenarios to see exactly what improved. Practice runs need no production data, so your security team can approve an evaluation that starts from a description without a data-sharing agreement.
See it in Nx·StudioDeterministic Cognitive Engine
Routine decisions are turned into fixed rules once, when a worker is built. A fixed rule can’t be flipped by “are you sure?” or a prompt trick. Policy holds because the rule is fixed, not because of careful prompting. The result is the same auditable answer on every run, for the worker’s entire production life. Replay shows it: same input, same path, same answer, every time.
Watch the engine route decisionsDeclarative Agent Blueprints
Every digital worker is a readable, versioned blueprint, not a tangle of prompts. It sets out what the worker does, who approves what, and where it escalates. Compare versions when policy changes, test it like code, trace exactly which version ran when, and hand it to your auditors. They read what the worker will do before it does it. The blueprint is the audit record, and like everything the platform generates, it’s yours.
Governance you can readThe Ownership Audit
Every delivery includes a written ownership statement: customer-owned source, no Nexgile runtime inside, no connection back to us, no licence check, no usage meter. It comes with a signed list of everything the delivery contains and a checker your own engineers run offline. Run it on your hardware, without trusting us. It confirms the package is exactly what was signed. A sanitized sample of its output is available on request. Because you hold the source, every line of that statement is yours to confirm. “No lock-in” stops being a slogan and becomes something you check yourself.
Verify it yourselfDon’t take our word for any of this.
Every delivery includes the Ownership Audit: a written ownership statement, a signed list of everything the delivery contains, and a checker your engineers run against it. It runs offline, on your hardware, without trusting us. A sanitized sample of its output is available on request. The result is yours to read.
And because every delivery carries a fingerprint of its contents, you can show that the code that was reviewed is the code that is in use.
Determinism (the same answer every time) gets the same treatment: shown, not just claimed. In any live session, ask us to replay the same input down the same governed path and watch it reach the same auditable output.
- Ownership statement source you own: no Nexgile runtime, connection back to us, licence check or usage meterships
- Signed list of contents every model, tool, connector and library in the deliveryships
- Offline checker confirms the package is exactly what was signedships
Runs on your hardware. The result is yours to read. And with a fingerprint of its contents on every delivery, you can show the code you reviewed is the code you put into use.
Your auditors read what a worker will do before it does it.
Governance here isn’t a dashboard that hides the logic behind it. It’s a set of records you can read, compare, and keep.
The blueprint is the audit record
Every worker is a readable, versioned blueprint. It sets out the worker’s agents and roles, integrations, human-approval gates, routing and decision rules. None of it is buried in prompts or locked inside a vendor’s systems. One record serves three audiences at once. Your engineers version and compare it like code, your governance team reads it before go-live, and your auditors check against it afterwards.
Every decision, traced end to end
When you include it in a delivery, every action is recorded on a tamper-evident audit trail with full decision lineage: which blueprint version ran, which fixed rule or live judgment fired, who approved what, and when. Routine decisions return the same auditable answer on every run. A clever prompt cannot talk them out of policy.
The reviewer inbox is code you own
Human approval is built into the worker itself: a reviewer inbox, with alerts by Slack, Teams, email and text message, and more than one approver for sensitive steps. All of it is delivered as code you own, not a dashboard you rent. Your approval policy is enforced in the software, not in a setting on our servers.
How we handle the data you choose to share.
Practice runs need no production data. Every preview, every simulation, and every replay happens on the Simulated Enterprise: sample data generated for each worker. You can import a sample file of your own, and that is always your choice.
Files you share to help with the design are different, and we treat them that way. You may choose to share documents, or a sample file of your own, so your workers reflect how you really work. If you do, you decide what to share, it’s used only to design your workers, and a data-processing agreement is in place before anything moves.
An evaluation that starts from a description shares nothing at all.
What’s deterministic, what isn’t, and who decides.
Live AI judgment is probabilistic by nature.
That’s why your workers use as little of it as possible. Every decision that doesn’t need live judgment is turned into a fixed rule that returns the same auditable answer on every run, and you can replay it to check. Same input, same governed path, same auditable output.
Where judgment is truly needed, workers run under confidence thresholds you set. You also decide what happens below the threshold: the worker stops, or the case goes to a person.
Escalation isn’t a courtesy. It’s a control.
What your auditors can request.
Every item below is sanitized and shared on request. Write to security@nexgile.com.
A sanitized blueprint excerpt
Presented as a readable document. Your governance team reads what a worker will do before it does it.
A sample evaluation report
Generated from a simulated run on the Simulated Enterprise. It is the document procurement will ask for.
A sanitized delivery in miniature
The repo tree, a real runbook page, and a test-and-coverage report from a simulated delivery. This is what “production-grade” means in practice.
A redacted security threat-assessment outline
What the security review delivered with a project covers. It is redacted to properties, never configurations.
The audit-trail specification
The events the tamper-evident audit trail records and the properties it guarantees.
The Ownership Audit’s sample output
A sanitized report from a completed run of the audit. The verdict is yours to read.
Your auditors can read what the worker will do before it does it.
Specific on purpose. Kept on purpose.
One plain sentence each, limited to what the platform proves. A specific pledge beats a sweeping one that can be proven false.
Practice runs need no production data. Previews and simulations run on generated sample data.
No vendor system in the middle. No fee per decision. No connection back to us.
Nothing stops working if you stop paying us.
Every number on this site comes with how we measured it. When we can’t measure something honestly yet, we don’t publish it.
The same rule covers other people’s numbers too. Third-party statistics appear only quoted, attributed, and dated. Our delivery counts carry a footnote on the method and are checked again before every publication. And figures we can no longer reproduce are removed across the site, not quietly kept.
Reliability
Because you self-host the software we deliver, its availability is in your hands: on your infrastructure, under your SLAs. Our own platform is continuously monitored, with a defined incident-response process. A public status page for Nexgile services is on our roadmap.
Talk to the right team
- Security & disclosure security@nexgile.com
- Privacy & data rights privacy@nexgile.com
- Accessibility accessibility@nexgile.com
You generate it. You preview it. You own it. You run it.
Bring your security, risk, and compliance teams. Every evaluation runs on the Simulated Enterprise, on generated sample data. Your security team can say yes on day one.