Preamble
This document states who decides, what gets recorded, where your information lives and what a Nuvnext agent can do. It describes what operates today. What is not written here, we do not promise.
For the technical detail of infrastructure and application, see Security.
In this document:
- Agent
- Intelligence that works inside your systems: it reads, proposes and leaves the work ready.
- Signature
- The approval of a person at your company, with their name and the time.
- Key
- The set of permissions of each agent, separate from that of the people.
- Log
- The record of every decision: the time, who made it and where the data came from.
1.Who decides
A person signs what is critical. A credit note, a message to a client or a movement of money waits for a person's approval before it goes out.
ISO/IEC 42001 A.9, use of AI systems.SOC 2 CC6.1.
Autonomy in levels. Permissions are assigned by role. You decide where the signature goes, process by process. It can move once you know what to trust. It cannot disappear.
The level of each process is agreed with you at kickoff; it does not come preconfigured.
Who moves the levels. Your company's leadership signs what is theirs to decide. You set the limit for each team role, not Nuvnext.
SOC 2 CC6.3, modification and removal of access.ISO 27001 A.5.18.
An agent does not approve itself. It can prepare an action. Approve it, never.
2.What gets recorded
Every decision is recorded: the time, who made it and where the data came from.
ISO 27001 A.8.15, logging.SOC 2 CC7.2.
The system writes it, not the agent. The record does not depend on what the agent says about itself.
What it is for. To know why a credit note went out for that amount, who authorized it and which document was in view, and to reconstruct the day something went wrong.
Sample entry. 09:31 · You · You approved credit note 0248 · On-screen review, with the return in view.
3.Where your data lives
Your database, your account. Your information lives in a database that belongs to your company, separate, in its own project. You create the account and you shut it down.
Nuvnext does not operate its own servers. The application and the database run on cloud providers with SOC 2 Type II certification.
Isolation lives in the database, not on the screen. Even if a query arrives without going through the application, the database only returns the rows that belong to whoever is asking.
- Row Level Security enabled on every table.
- Every view respects the permissions of its source tables.
- Users and visitors have no permission to empty an entire table.
All three are verified by an automated sweep on every code change.SOC 2 CC6.1 · ISO 27001 A.8.3.
Encryption. TLS 1.2 or higher on every connection, with HTTP Strict Transport Security. AES-256 at rest in the database, the backups and the files. Keys and secrets live in the provider's variable manager, never in the code.
ISO 27001 A.8.24, use of cryptography.SOC 2 CC6.7.
The language model receives the task, not your database. It receives the text the task needs. Your database does not leave your account.
ISO/IEC 42001 A.7, data for AI systems.
Personal data. We process it in accordance with Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP). The purposes, the transfers and the exercise of ARCO rights (access, rectification, cancellation and opposition) are set out in the privacy notice, available in Spanish. We do not sell or trade personal data.
LFPDPPP privacy notice, ARCO rights.ISO 27001 A.5.34.
4.What an agent can do
Four permissions, by role. Everyone sees and does what their role allows. So does the intelligence.
| Read | Propose | Approve | Send outside | |
|---|---|---|---|---|
| Leadership | Everything, by module | Any action | What is theirs to decide | With their signature |
| Team | Their role | Their area | Within the limit you set | With the signature of whoever is responsible |
| Agent | What its key allows | Leaves the action ready | Never | Never without a signature |
| Client | Their project, in their portal | Forms and requests | Their own documents | Does not write to your systems |
SOC 2 CC6.1 · ISO 27001 A.5.15, access control; A.8.2, privileged access rights.
Least privilege. Each agent has its own key, separate from that of the people, and reads only the modules its work requires.
What an agent never does.
- Approve its own work.
- Send anything outside your company without a person's signature.
- Read beyond what its key allows.
5.Controls
A framework of 50 controls. Each control is mapped to the standards that procurement and audit teams use: SOC 2, ISO/IEC 27001:2022, NIST CSF 2.0, CIS Controls v8, ISO/IEC 42001, LFPDPPP, GDPR and the EU AI Act.
Mapped, not certified. Nuvnext does not hold a certification of its own; its cloud providers do (SOC 2 Type II).
What is checked automatically. On every code change: isolation on every table, views that respect permissions, no table that can be emptied, validated redirects, the schema versioned in the repository and the lock that keeps confidential material out of the history. If a change breaks a control that was already passing, it is flagged before it goes in.
Backups are reviewed against the provider on the first day of each month.
SOC 2 CC8.1 · ISO 27001 A.8.32, change management.SOC 2 A1.2 · ISO 27001 A.8.13, information backup.
Documentation for your security team. The security questionnaire (SIG Lite, CAIQ or your company's format) and the control-by-control mapping, on request. The data processing agreement, together with the contract. The list of subprocessors, under a confidentiality agreement.
Full technical detail in Security.
6.What we do not promise
That it never makes mistakes. It does. That is why a person signs what is critical, everything goes into the log and every decision sharpens it.
Because whoever answers for the company is going to ask anyway.
That we hold a certification. We do not. We work toward enterprise and international standards, and we give you the evidence your auditor works with.
That it installs itself. Where the signature goes is decided with you, process by process.
That the risk is zero. Nobody can promise that. What we do give you is knowing what happened, when, and who approved it.
7.Security contact
Vulnerability reporting. If you find a vulnerability, write to us at seguridad@nuvnext.com before making it public. We respond within two business days at most and let you know when it has been fixed.
ISO 27001 A.5.24, incident management.LFPDPPP notice of security breaches.
Good faith. We do not take legal action against anyone who reports in good faith. We ask that you not access, modify or delete third-party data, not degrade the service, and give us a reasonable time to fix the issue before disclosing it.
Policy published at nuvnext.com/.well-known/security.txt, in accordance with RFC 9116.