NexavateAI Trust Center

Compliance

NexavateAI implements industry-standard security controls and is designed to support your organisation's compliance requirements. This page describes what we have implemented, how we support enterprise buyers, and what to expect in your security evaluation.

Last updated: July 2026 · This page does not constitute legal advice. Consult your compliance team.

Honest about certifications

Industry best practices

Controls matrix

Customer-managed option

Our Compliance Posture

An honest view of where we are

Transparency note: NexavateAI applies security controls aligned with common enterprise expectations. We do not hold formal ISO 27001, SOC 2, HIPAA, or GDPR certifications at this time. This page describes what is operationally available on the platform.

What we have

Operational security controls aligned with common enterprise expectations
Designed for customer compliance support
Transparent data practices & processor list
Customer-managed deployment option
Ongoing security improvement roadmap

We do not claim

ISO 27001 certification
SOC 2 Type I or II certification
HIPAA certification (not a certifiable standard)
GDPR certification
PCI DSS compliance

Framework Alignment

Standards our controls are designed to align with

While we hold no formal certifications, our security controls are designed to align with principles from these widely-recognised frameworks. Enterprise customers may use this as input for their own compliance assessments.

OWASP Top 10

Web application security risks. Our API and frontend follow OWASP guidelines — input validation, secure headers, no credential exposure, etc.

Aligned

NIST Cybersecurity Framework

Identify, Protect, Detect, Respond, Recover — core CSF functions represented in our security controls and incident posture.

Principles followed

ISO 27001 principles

Information security management principles (Annex A). Controls implemented; formal audit/certification not yet completed.

Principles, not certified

GDPR readiness

Privacy by design, data minimisation, processor agreements, right to erasure support. Not audited or certified by a supervisory authority.

Designed for, not certified

HIPAA security considerations

NexavateAI is not a HIPAA-covered entity by default. Enterprise deployment options can support customers pursuing HIPAA compliance, subject to contractual agreements and appropriate organizational controls.

Contract-dependent

India IT Act / DPDP Act

Data protection obligations under Indian law including the Digital Personal Data Protection Act 2023 — data minimisation, purpose limitation, data principal rights.

In scope

Security Controls Matrix

Operational controls across access, data, network, and operations

Domain	Control	Description	Status
Access control	OTP email verification	All patient bookings require verified email OTP before data submission	Operational
	Role-based access	Patient, staff, admin roles with separate API access scopes	Available
	Admin authentication	Admin dashboard protected by authentication controls	Available
	Session management	Session IDs, expiry, and per-email isolation for OTP flows	Operational
Data protection	TLS in transit	All API and third-party communication over HTTPS/TLS	Available
	Encryption at rest	MongoDB Atlas provides encryption at rest for stored data	Platform managed
	OTP hashing	SHA-256 with session and API key pepper; raw OTPs never persisted	Operational
Secrets & config	Environment variables	All API keys and credentials in env vars; excluded from version control	Available
Secrets & config	No hardcoded secrets	Source code excludes live credentials from version control	Supported
Monitoring	API audit logging	OTP events, appointment actions, errors logged with timestamps	Operational
	Error alerting	Failed OTP deliveries, API errors, missing configs logged at startup	Operational
	SIEM integration	Structured logging compatible with SIEM tooling on customer-managed deploy	Customer managed
Availability	Database backups	MongoDB Atlas continuous backup with point-in-time recovery	Platform managed
Availability	Graceful degradation	AI unavailability handled with user-visible error messages; booking flow preserved	Supported
Vendor management	Sub-processor list	Published disclosure on Privacy Policy and Subprocessors page	Published
Vendor management	Processor agreements	Contractual terms with subprocessors govern data handling	In place

Enterprise Customer Compliance Support

How we support your organisation's compliance obligations

We recognise that healthcare enterprises may have specific compliance obligations. NexavateAI can support these in the following ways:

Security questionnaires

We complete vendor security questionnaires for enterprise evaluations. Contact us with your specific requirements.

Customer-managed deployment

Deploy within your own cloud environment for full data residency control. Supports alignment with internal security policies.

Data processing agreements

DPA / DPIA documentation available for enterprise customers requiring formal data processing agreements.

Incident response SLA

Enterprise contracts include incident notification SLAs and defined response timelines for security events.

Data Residency

Where data is stored across the platform

Data type	Storage location	Residency options
Appointment & patient records	MongoDB Atlas	Region selectable at deployment configuration
Knowledge base embeddings	Qdrant (cloud or self-hosted)	Region configurable by deployment
AI inference (OpenAI)	OpenAI API services	Processing region depends on provider configuration
Email delivery (Resend)	Resend transactional email	Alternative email provider configurable for customer-managed deployments
Application / static assets	Hosting provider (deployment-dependent)	Customer-managed deployments support customer-selected regions

Sub-processor Notification

Our full list of subprocessors is published on the dedicated Subprocessors page and summarized in the Privacy Policy. Enterprise customers may receive notification of material subprocessor changes where contractually required.

Healthcare Regulatory Context

How we position relative to healthcare regulations

NexavateAI is a healthcare operations software platform — not a medical device, clinical decision support system, or Electronic Health Record (EHR). Our AI features do not provide medical diagnoses or clinical recommendations.

What we are

Healthcare SaaS — scheduling, patient communication, admin workflow
AI-assisted operations (not AI-guided clinical care)
Appointment management and clinic administration software

What we are not

A regulated medical device (not registered/cleared as one)
A clinical decision support system
A HIPAA-covered entity (customer organization holds primary compliance obligations)
An Emergency Health Service

Enterprise Buyers

What enterprise and hospital procurement teams can expect

For clinics, hospital groups, and healthcare enterprises evaluating NexavateAI, we provide:

Security questionnaire responses — tailored to your procurement process
Data Processing Agreements (DPA) — available for GDPR and other regulatory contexts
Architecture documentation — technical documentation for security and procurement review
Customer-managed deployment — for organisations requiring on-premises or private cloud control
Custom contractual provisions — for specific compliance or data handling requirements, subject to agreement

Start your compliance evaluation

Email us with your organisation's specific compliance requirements, regulatory context, and technical questions. We will arrange a compliance briefing with your security team.

info@nexavateai.com