Security at CISONexus
Last updated: September 12, 2026We sell to the most demanding security audience there is. Here is exactly how the platform that runs your security program protects itself, in the cloud or entirely on your own infrastructure.
Deployment models
CISONexus runs wherever your risk appetite says it should. Choose the managed cloud for speed, or the on-premise edition when data residency, regulation or policy requires that nothing leaves your estate.
On-premise deployments include the full platform: every module, Nexus Brain and the AI agents, with model connectivity configurable to your approved providers or restricted entirely.
Fully managed by us: hardened hosting behind Cloudflare, encrypted transport, isolated customer workspaces, monitored around the clock, and updated continuously without customer effort.
The complete platform installed inside your own data center or private cloud. Your data never leaves your infrastructure: you control the network, the storage, the keys and the update cadence, with our team supporting installation and upgrades.
Data protection and encryption
- All traffic is encrypted in transit with TLS; the public site and cloud service sit behind Cloudflare with edge protection.
- Credentials are never stored in plain text: passwords are salted and hashed, two-factor secrets and backup codes are stored hashed.
- Each customer workspace is logically isolated with strict tenant separation enforced at the data layer.
- On-premise: encryption at rest and key management follow your own infrastructure standards, under your control.
Access control and authentication
- Role-based access control with a permissions matrix across every module, down to admin, analyst, auditor and viewer roles.
- Two-factor authentication (TOTP) with hashed backup codes on every account.
- Single sign-on with Google and Microsoft, enabled and governed by your administrators; SSO/SAML available on Enterprise.
- Session management with device visibility and one-click revocation, IP allowlisting, and configurable session lifetimes and lockout policies.
Auditability
A platform for governing security must itself be governable. Every sign-in, permission change, record change and AI agent action is written to an immutable audit trail with actor, timestamp and context. AI findings carry their reasoning and sources, and agent autonomy is configurable from suggest-only to approved execution, so accountability always traces to a person.
AI security
- AI agents operate at the autonomy level you set, with every step recorded and reversible.
- Workspace content is never used to train models.
- The public AI CISO chat runs with strict rate limits, abuse protection, an instruction set that refuses harmful requests, and anonymous sessions.
- On-premise deployments can restrict or fully disable external model connectivity.
Platform and operations
- Hardened build pipeline with type-checked releases and dependency review.
- Continuous backups for the cloud service, with tested restore procedures; on-premise backup schedules run under your policies.
- Least-privilege operational access for CISONexus staff, with production access logged.
- Full JSON export of your workspace at any time: your exit path is part of our security posture.
Compliance alignment
The platform is built to operate programs against ISO 27001, SOC 2, NIST CSF 2.0, GDPR, PCI DSS and HIPAA, and our own practices are aligned to the same control families we ship: access control, change management, logging, retention and incident response. Security documentation and our latest assessments are available to customers and serious evaluators under NDA on request.
Responsible disclosure
We welcome coordinated disclosure from the security community. If you believe you have found a vulnerability in cisonexus.com or the platform, email [email protected] with the details and steps to reproduce. We acknowledge reports within two business days, keep you informed as we remediate, and will credit you if you wish. Please avoid accessing other users’ data, degrading the service, or public disclosure before a fix is released.