NEXORIQ Security Architecture
Security is not an afterthought in NEXORIQ. Every layer of the platform is designed with strict tenant isolation, least-privilege collectors, and tamper-evident audit controls.
PostgreSQL Row-Level Security (RLS)
Tenant isolation is enforced directly at the PostgreSQL storage engine level. Every database transaction sets a scoped session variable. If unconfigured or missing, RLS policies immediately reject read and write attempts.
- Transaction-scoped SET LOCAL app.current_organization_id
- Connection pool DISCARD ALL on checkout/return
Dual Authentication Lifecycles
Web users authenticate via Argon2id password hashes and AES-256-GCM encrypted TOTP MFA. Desktop agents communicate via signed Ed25519 asymmetric requests with cryptographic nonces and strict clock skew validation.
- HttpOnly, Secure, SameSite=Strict session cookies
- Outbound-only agent communication over TLS 1.3
Hardened SSRF & DNS Rebinding Guard
Cloud scans are physically prevented from probing internal networks or cloud metadata. DNS is resolved once and socket-pinned to validated public IPs, blocking TOCTOU DNS rebinding.
- Blocks loopback, RFC1918, link-local, and 169.254.169.254
- Redirect target re-validation on every hop
AI Privacy & Evidence Grounding
Customer evidence is pre-redacted before any AI interaction. Prompts are wrapped in strict XML boundaries. All AI-generated claims must cite verified finding IDs existing in the database.
- Credential, hash, and IP entropy redaction
- Rejection of hallucinated finding citations