Security & Trust Center

Built for teams who operate
in demanding markets.

ONX is designed to meet the security and governance expectations of enterprise procurement, legal, and security teams, without compromising speed or commercial value.

Encryption at rest & in transit

GDPR-aligned architecture

EU AI Act: controls built in

Role-based access & RLS

Security Architecture

How data flows through the ONX platform, from customer browser to database, and out to external processors. Encryption boundaries and tenant isolation are highlighted.

ONX, Security Architecture Overview

Customer Browser

User / Sales Rep

HTTPS only

TLS 1.2+

Edge Layer

Vercel Edge

Global CDN · HSTS enforced

authenticated request

Application Layer, Vercel (US)

ONX App

Next.js · API Routes

Supabase Auth

JWT tokens · session management

org-scoped query

Data Layer, Supabase / AWS eu-north-1 (Stockholm)

PostgreSQL DB

AES-256 at rest

RLS enforced

Audit Trail

Append-only · immutable

TTL enforced

External processors, SCCs in place

AI Inference

Anthropic

Company context only

No personal data

OpenAI

Supplementary flows

No personal data

Enrichment & Research

People Data Labs

Firmographic data

Business data only

Perplexity AI

Public web signals

Business data only

Encrypted transport (TLS 1.2+)

Tenant isolation (RLS)

AES-256 encryption at rest

No personal data to AI providers

Infrastructure

Cloud providerAWS (via Supabase), eu-north-1 (Stockholm), EU only

Application hostingVercel, global edge network, serverless

DatabaseSupabase (PostgreSQL), managed, SOC 2 Type II

Network isolationSupabase project-level isolation; Vercel project isolation

DDoS protectionVercel edge network + AWS infrastructure protection

LoggingApplication and access logs retained for security review

Encryption

Encryption at restAES-256, AWS / Supabase managed keys

Encryption in transitTLS 1.2+ enforced on all connections

HTTPS enforcementHSTS enabled; HTTP redirected to HTTPS

Database connectionsTLS-enforced PostgreSQL connections

Secret managementEnvironment variables via Vercel; not stored in codebase

Customer-managed encryption keys (CMEK) are available on Enterprise plans on request.

Access Controls

Row-Level Security (RLS) enforced at the database layer, tenants cannot access each other's data

Organisation-scoped data isolation, all queries are scoped to the authenticated org

Role-based permissions, admin, member, and read-only roles

JWT-based authentication with short-lived tokens

SSO available on Enterprise plans (SAML 2.0)

Internal access to production data is restricted and audited

No Optimal Nexus employee accesses customer data without documented purpose

Data Governance & Privacy

Lawful basisLegitimate Interest (GDPR Article 6(1)(f))

Contact data TTL120 days from ingestion, auto-expiry, no silent renewal

Data minimisationField-level allowlist at ingestion; 40+ personal categories blocked

Special category dataNot processed (Article 9 GDPR)

Automated decisionsNone, all AI output is decision-support only

Cross-border transfersStandard Contractual Clauses (SCCs) where applicable

Right to erasureGlobal suppression list, one-click, permanent, cross-account

Right to accessMachine-readable JSON export via compliance API

DPIASoft DPIA completed; downloadable from Compliance Center

LIALegitimate Interest Assessment on file; available to enterprise customers

Compliance Documents Privacy Policy

AI Governance

EU AI Act, Our Approach

Every AI feature in ONX is decision support with human review, per-decision logging and accuracy monitoring. Most features are commercial decision-support outside the Act's high-risk categories; where a feature touches Annex III territory, candidate–job match scoring in Hiring. It is operated under the Act's strictest control framework: mandatory human review before any score is used, stated reasoning alongside every score, per-decision audit logs and candidate notification. The assessment is reviewed annually and whenever processing materially changes.

AI providersAnthropic (Claude) by default · Perplexity (web intelligence) · OpenAI / Gemini available only via customer-supplied keys

Use of AIRecommendations, confidence scoring, pattern detection, briefings and copilots, decision support across the platform

Personal data in promptsMinimised, commercial features use company-level context; hiring and people features process personal data under the customer's lawful basis, with review gates

Model training on customer dataNo, contractually prohibited with all AI providers

Automated decisionsNone, human review required before any AI output is acted on

Confidence disclosureAI outputs surfaced as indicators with evidence states, not deterministic facts

Annex III-relevant featuresCandidate–job matching runs under mandatory human review gates, reasoned scores, audit logs and candidate notification

Full AI Transparency Notice

Subprocessors

ONX uses a limited set of third-party subprocessors. Each is covered by a DPA and Standard Contractual Clauses (SCCs) where data is transferred outside the EEA. 30 days' notice is provided for new subprocessors.

SupabaseDatabase & authentication · EU, Stockholm (eu-north-1) · EU-hosted

VercelHosting & CDN · Global edge / EU configurable · SCC

AnthropicAI inference · US · SCC + DPA

People Data LabsData enrichment · US · SCC

Perplexity AIWeb intelligence · US · SCC

ResendTransactional email · US · SCC

Full subprocessor list with DPA details

Uptime & Reliability

Target availability99.9% uptime SLA (Enterprise plans)

InfrastructureVercel serverless + Supabase managed PostgreSQL

RedundancySupabase automated backups with point-in-time recovery

MonitoringApplication health monitored continuously

Maintenance windowsCommunicated in advance via in-platform and email

Enterprise SLA documentation available on request.

Incident Response

Security incidents are triaged within 4 hours of detection

Data breach notification to affected customers within 72 hours of confirmed breach, in line with GDPR Article 33

Supervisory authority notification within statutory timescales where required

Post-incident review and root cause analysis completed for all material incidents

Incident log maintained internally; material incidents disclosed to affected customers

To report a suspected incident: security@optimalnexus.com

Vulnerability Disclosure

Optimal Nexus Ltd operates a responsible disclosure policy. If you discover a security vulnerability in ONX, we ask that you report it privately before public disclosure so we can investigate and resolve it.

Report vulnerabilities to security@optimalnexus.com

Include a description, reproduction steps, and potential impact

We will acknowledge receipt within 2 business days

We will keep you informed of our investigation progress

We will not pursue legal action against good-faith reporters

We are not currently operating a formal bug bounty programme. This is under review.

Compliance Roadmap

Current posture and planned milestones. We publish this because enterprise buyers deserve an honest picture, not a marketing badge.

✓GDPR-aligned architecture (RLS, TTL, suppression, LIA, DPIA)

✓AI Transparency Notice (EU AI Act alignment)

✓Subprocessor register with SCCs

✓Data subject rights, access, erasure, objection, portability

✓Immutable audit trail for all processing decisions

~Formal DPA template for enterprise customers

~Penetration testing (scheduled)

~Vendor risk register

○SOC 2 Type II audit

○ISO 27001 certification

○Formal bug bounty programme

Download the procurement pack

DPIA · LIA · AI Transparency · Subprocessors, generated live, always current.

View downloads

Need documentation for procurement?

DPA, DPIA, subprocessor list, AI governance summary, available on request.

Request documentation

Platform Privacy Policy Terms of Service Subprocessors AI Transparency security@optimalnexus.com

Built for teams who operate in demanding markets.