Security
Built with financial operations in mind.
Architecture designed with enterprise security requirements in mind, and an honest account of what still has to happen before real customer data goes anywhere near it.
Controls
What is enforced in the product.
Role-based access
Administrator, analyst and read-only roles. Enforced by database policy, not only by hiding buttons in the interface — a read-only user cannot create a case even by calling the API directly.
Tenant isolation
Every record belongs to one institution and is filtered by row-level security. A case belonging to another institution reads as not found, even when addressed by its exact identifier.
Append-only evidence
Transcripts and audit entries reject updates and deletes at the database level, including from the service credentials the application itself uses.
Workflow controls
The agent can only ask questions an administrator has approved. It cannot add a question, and it cannot request a credential.
Sensitive-data minimization
No PIN, password, CVV or full card number is requested or stored. The database has no column capable of holding one; only the last four digits of a card are retained.
Secrets handling
Provider credentials come from environment configuration. Keys that bypass access control are server-side only and cannot be imported into browser code.
Human review
No autonomous account action exists in the product. There is no control that declines a transaction, freezes an account or records a fraud determination.
Auditability
A record that cannot be quietly changed.
Who did what, when, and whether it was a person, the system, or the AI.
- 14:02:11case.createdHuman · A. Moreau
- 14:02:12call.initiatedSystem
- 14:02:41call.answeredSystem
- 14:02:44question.askedAI
- 14:02:58customer.response_receivedAI
- 14:06:15call.completedSystem
- 14:06:17transcript.completedSystem
- 14:06:29summary.generatedAI
- 14:31:04case.openedHuman · A. Moreau
Entries cannot be edited or deleted after they are written — the database rejects both, including from the service role.
Certifications
What we do not claim.
CheckNexa does not currently hold SOC 2, PCI DSS or ISO certification, and does not present itself as certified. If a vendor page tells you otherwise, it is not this one.
The architecture is designed so those programmes are achievable, and we are happy to walk your risk team through the controls above in detail.
Required before production use
- Institution-specific security, privacy, regulatory and compliance review
- Penetration testing and a documented threat model
- Enforced rate limiting on authentication and public endpoints
- Implemented webhook signature verification for the telephony provider
- Field-level encryption or tokenisation for customer data
- Data retention and erasure policy, including call recordings
- Call-recording consent capture appropriate to each jurisdiction
- Model risk governance and human-review sampling for AI summaries
Production deployments require institution-specific security, privacy, regulatory and compliance review.
Bring your risk team to the demo.
The controls above are the part of the conversation we most want to have.