Compliance
Execution records built to support evidence, not a certificate we issue.
Nexus does not certify an organization's compliance posture. It generates the execution records, access evidence and audit trail that an organization's own compliance function can use to support its posture against the frameworks that apply to it.
- not certified by Nexus
- Aligned withnot certified by Nexus
- processing and decision records
- Per-executionprocessing and decision records
- retention and reporting fields
- Configurableretention and reporting fields
- your responsibility, always
- Your postureyour responsibility, always
Our position
Nexus does not confer certification. It supports the evidence a certification requires.
This distinction matters and we want to be direct about it rather than let vague language imply otherwise.
Alignment, not certification
Where this page or any Nexus material references a regulatory or security framework, the language used is aligned with or maps to. Nexus is not accredited to issue certifications against these frameworks, and using Nexus does not automatically make a deployment compliant.
The compliance posture belongs to the deploying organization
Assessing which frameworks apply, configuring the platform to meet the organization's specific obligations, and engaging with auditors or regulators are all the responsibility of the organization deploying Nexus, not Nexus itself.
Questions
Compliance evidence, scope and responsibility.
Does using Nexus make an organisation compliant?
No. Nexus can produce execution, access and decision records that support an organisation's evidence process. The organisation remains responsible for its controls, assessment and regulatory obligations.
Does Nexus issue certifications?
No. References to frameworks describe potential alignment or control mapping. They are not a certification of Nexus or of a customer environment.
Can retention follow an organisation's policy?
Execution records can be retained according to configured policies. The organisation decides the applicable period and confirms that configuration against its obligations.
How execution records help
What the platform actually generates that a compliance team can use.
Evidence gathering is usually the slowest part of a compliance exercise because it means reconstructing what happened from several disconnected systems.
- Access evidence
- Role assignments, authentication events and separation of duties configuration, drawn from identity and RBAC records, support access control evidence requests.
- Processing evidence
- The execution record for a workflow shows what data was retrieved, what rules and AI steps ran, and what system action followed, supporting data processing evidence requests.
- Decision evidence
- Where a human approval step is configured, the reviewer identity and decision are retained, supporting evidence that a required human control was actually exercised.
- Change evidence
- Versioning of workflows and rules lets an organization show which version was in force at the time of a given decision.
- Retention evidence
- Execution records are retained according to policies the organization configures, so retention periods can be set to match a specific regulatory requirement.
Frameworks referenced
Frameworks organizations commonly ask about, and how alignment works for each.
This list is illustrative of how the alignment language applies, not a claim of certification against any of them.
Data protection frameworks such as GDPR
Deployment on infrastructure the organization controls, together with self-hosted models and vault-backed secrets, can be configured to align with data minimization, access control and processing record obligations described in data protection frameworks. The organization's data protection officer remains responsible for its own assessment.
Security frameworks such as ISO 27001
Identity, access control, secrets management and audit logging capabilities can map to control objectives commonly referenced in information security management frameworks. Nexus does not issue an ISO 27001 certificate on behalf of a customer's environment.
Sector-specific obligations such as NIS2
Incident-level execution records, retention configuration and reporting fields can be configured to align with incident reporting expectations described in frameworks such as NIS2. The deploying organization remains the entity that files any required regulatory notification.
Who owns what
A clear division of responsibility.
Shared responsibility for compliance
Nexus is responsible for building a platform whose access control, audit and evidence-generation capabilities can be configured to align with common regulatory and security frameworks, and for being accurate about what those capabilities do and do not do.
The deploying organization is responsible for determining which frameworks apply to it, configuring retention and reporting settings to match its obligations, and presenting evidence to its own auditors or regulators. Nexus does not act as the organization's compliance function.
Relevant capabilities
Where evidence generation is implemented.
Governance and Audit
Identity, RBAC and the execution record in detail.
ExploreTechnical assurance
Signed reporting and reproducible execution records.
ExploreSecurity architecture
The controls that generate access and processing evidence.
ExploreNexus Cerberus
AI-BOM scanning and testing mapped to MITRE ATLAS.
ExploreArchitecture session
Bring your compliance team the specific framework you need to address.
We will walk through exactly which execution records and configuration options are relevant, and where the responsibility stays with your own compliance function.