信任与安全
关于 Neurixmedia、Neurix Core 和 Neurix One 的安全、隐私与供应商准备信息。
This Trust Center summarizes implemented controls, partial controls, planned controls, and explicit non-claims. It is not a certification statement.
Last updated: June 15, 2026
Security
Authentication boundaries, session protection, and operational access controls.
Admin routes require authenticated staff sessions with module permissions.
Invited client users access portal sections through authenticated sessions.
Tenant invitations use hashed tokens; raw tokens are not returned in list APIs.
Tenant isolation
Database and application isolation for multi-tenant client data.
Tenant-scoped tables enforce client isolation at the database layer.
Membership rows link users to clients for portal scope resolution.
Portal sections require explicit entitlement keys; billing does not auto-unlock access.
Identity & access
Identity provider readiness, admin permissions, and access governance.
Keycloak OIDC scaffold is present; activation remains feature-flagged.
Admin module permissions gate sidebar visibility and page access.
AI governance
Scoped public assistant behavior and server-side provider configuration.
Public assistant is FAQ-first and limited to Neurixmedia-approved topics.
Model provider keys remain server-side; not exposed to browsers.
Data handling
Hosting disclosure, privacy policies, and data category transparency.
Production hosting region depends on approved deployment configuration.
Public privacy disclosure covers forms, portal, and assistant data.
Audit logging
Structured audit events for foundation operations — no raw webhook payloads.
Membership, invitation, billing, and portal actions emit structured audit events.
Billing & payment safety
Checkout safeguards, no card storage, and internal Subscription as source-of-truth.
Billing checkout, admin writes, and client portal billing UI are feature-flagged off.
Neurixmedia application code does not store card numbers or CVV data.
Incident readiness
Operator checklists and published security contact paths.
Operator checklist for rotating compromised or stale secrets (M0).
Published contact channel for security and privacy inquiries.
Honest gaps and in-progress items — not hidden and not softened.
Formal SOC 2 / ISO audits are planned controls, not current claims.
Some hosting and subprocessor details finalize at production cutover.
Strategic alignment
Neurixmedia aligns product and governance language with themes from the UAE National Strategy for Artificial Intelligence 2031. This describes our design intent — not government endorsement or regulatory approval.
FAQ-first public assistant, scoped use cases, and human review paths for sensitive topics.
Admin-configurable AI settings, audit-friendly operations, and default-deny portal entitlements.
Documented foundation phases (M0–M5) so teams can onboard with clear control expectations.
Server-side provider keys, no client-side secret exposure, and scaffold-only billing until founder activation.
Structured knowledge, promotions, and assistant tooling to improve response quality without overclaiming automation.
Strategic alignment only — not UAE government endorsement, certification, or approval.
For security or privacy questions, contact
We review good-faith reports during business hours. This is not a 24/7 incident response hotline unless separately contracted.
