Security & compliance · GDPR
Every deployment is a single-tenant system processing only the client's own documents, on infrastructure the client chooses. Compliance is built in, none of it is paperwork after the fact, and all of it is verifiable below.
Nothing here is paperwork after the fact: each article the GDPR asks of a processor lands as a mechanism a reviewer can press. And Article 22 stays not applicable by design — the assistant answers questions with citations; it decides nothing about persons and executes nothing.
Self-service “Export my data” for every signed-in person — JSON, complete, machine-readable by construction — plus an administrator subject-access export for any subject the deployment knows.
Correct the source document; the next sweep re-indexes it; the corpus mirrors its sources.
Hard delete, everywhere: store and search index in one action; erasure itself lands on the audit log; no tombstone remains.
Each deployment contracted under a DPA including the sub-processor notice procedure.
The deployment generates its own record-of-processing manifest from the configuration that actually runs.
Export is one button — complete, machine-readable, for every signed-in person. Rectification is the source document: correct it, and the next sweep mirrors it. Erasure is deletion, not flagging. Every mechanism is self-service for the people it belongs to, and each run lands on the audit log.
Erasure & exports, in the docs ›
A deletion that leaves a stub is not an Article 17 erasure — a title or file path can identify a person on its own. So erasure removes the record itself, store and search index in one action, and what remains is only the audited fact: who ordered it, when, over what scope. Never the content. Deployments that must not retain message content at all run the audit log in metadata-only mode, and retention itself is an explicit, configurable value enforced nightly.
The audit chain that proves it ›
Each deployment is contracted under a DPA with a written notice procedure for sub-processor changes. The fullest configuration has no sub-processors at all — self-hosted, answering entirely on its own hardware. Otherwise exactly two categories exist: the Naxis AI service, zero-retention in writing, and for managed hosting an EU data-centre provider.
What leaves, and what never does ›
The papers this page rests on, readable right here — the GDPR mapping, the DPA structure, the sub-processor notice and a generated manifest. Request forms never gate the reading.
The rights articles as product mechanisms: export, erasure, records of processing, each one built in, none of it paperwork after the fact.
Every Naxis deployment is a single-tenant system processing only the client's own documents, on infrastructure the client chooses. GDPR compliance is implemented as product mechanisms, not policies:
The generated manifest for a specific deployment is available to its administrator at any time; a sample is in Technical documentation below.
An account action, the request files under your Naxis account, and the answer arrives on its thread.
The DPA every deployment is contracted under, subject matter, duration, sub-processor notice procedure, audit rights, deletion on termination.
The signed DPA is executed per client. Its structure, so your legal team knows what to expect:
Request the full template, or a signed copy for review under NDA, through the contact page; it is provided as a matter of course.
An account action, the request files under your Naxis account, and the answer arrives on its thread.
At most two categories exist, and the fullest configuration, self-hosted with self-hosted AI, has none.
Changes to either category follow the DPA's written notice procedure. There are no analytics, advertising or telemetry processors, the product ships none.
An account action, the request files under your Naxis account, and the answer arrives on its thread.
Every deployment renders one of these from its own live configuration, this is the shape of it.
Generated, not written: the values below come from a deployment's actual configuration at generation time.
Administrators export the real manifest for their deployment from the console at any time.
An account action, the request files under your Naxis account, and the answer arrives on its thread.
Need the signed copies? Request the DPA from your account and the template lands on your own thread; the full trust library carries the rest.
Yes, when it is built as a processor should be: a single-tenant deployment processing only the client's own documents, under a DPA, with export, erasure and records of processing implemented as product mechanisms. That is the entire design position of Naxis Assistant.
As deletion, not flagging. Erasing a person's conversations or a single document removes the records from the store and the search index in one action; no tombstone remains. Only the audited fact that an erasure happened survives.
Nobody writes them, the deployment generates its own record-of-processing manifest from the configuration that actually runs: data categories, retention values, sub-processors, technical measures, rights handling. Generated paperwork cannot drift from reality.
At most two categories, and the fullest configuration has none: a self-hosted deployment that answers entirely on its own hardware processes everything in-house. Otherwise: the Naxis AI service (zero-retention DPA terms, receives only the question and permitted excerpts) and, for managed hosting, an EU data-centre provider. Changes follow the DPA's written notice procedure.
Request it from your account, the template arrives on your own thread, and the signed copy is executed per client. Your legal team can see the structure on this page first.
No third-party scripts, no third-party cookies, no analytics service. The site keeps a first-party visit log on its own server (page, referrer, reading time, IP-derived country, device, request headers), with one first-party cookie holding a random visitor identifier so a returning browser counts once; both are described with their retention in the privacy notice. An account stores what you give it, and page views made while signed in are linked to it; the interactive demo records usage under an explicit opt-in described there too.
Every paste into a consumer chatbot is a question your own systems could not answer fast enough. Security vendors sell detection, which reads the app and never the question. What the 2026 breach data actually shows, how far Microsoft's new Shadow AI controls really reach, and why the only fix that scales is making the company answerable.
Glean is Google for your company: it finds where things are stored. Naxis is the private knowledge engine that knows what is actually true right now. Different machines, different questions, different prices. An honest way to choose, and the Glean alternative for companies of 5 to 200 people.
Lidl wrote off €500 million trying. Birmingham City Council is £144 million in and reinstalling from scratch. Consolidation megaprojects fail for a structural reason: real work is too fluid to hold one shape. The part you actually wanted, one place to ask, never needed the migration.
