What Nyxus does not do

The fastest way to understand a product like this is to find out what it
refuses to claim. Everything here is a deliberate limit, and knowing them will
save you from describing Nyxus to your board as something it is not.

It is not in the path

Nyxus is not a proxy, a gateway, a CASB or a DNS filter. It does not sit
between anybody and the tool they are using, and it cannot stop somebody
reaching one.

The consequence is the good news: there is nothing to break. No latency, no
TLS interception, no outage that takes the company's tooling down with it.
Nyxus reads what already happened.

The paste guard is the one exception, and even that is not in the path: it is
a browser extension that intercepts a paste on the machine, before the
content reaches the page, and warns or blocks there. It cannot stop the same
person using their phone.

It does not read what people write

No prompt is captured. No response is captured. No pasted text is stored,
transmitted or seen - the paste guard scans on the machine and reports which
detectors matched, never the content that matched them.

Account detection takes the same line: the browser extension resolves the
signed-in address, discards the local part immediately, and reports the domain
only. Nyxus knows somebody signed in with a gmail.com address. It does not
know which one.

This is why Nyxus is deployable in places where AI monitoring is not. What it
collects is closer to an inventory than to surveillance, and
Privacy and data protection for deployers sets out
what that means for your DPIA.

Presence is not use

A tool in an MDM inventory is installed. It is not evidence anybody opened it.
An MCP server in a configuration file is configured. It is not a record of a
call being made.

Nyxus says which of those it knows, everywhere it shows you a number, and it
will not quietly upgrade one into the other. A page that could only say
"installed" says "installed".

Not observed is not absent

Every count is a count of what reported. If a collector is not on a machine,
that machine contributes nothing - not a zero, an absence. If a source is
silent, the ground it covers is not covered.

This is why Coverage gaps exists as a page, and why the console is careful
with the word "silent". A quiet source is a statement about Nyxus, not a
clean bill of health for your estate.

It does not decide anything for you

A rule can act on the register, and no rule overrides a decision somebody
recorded. Nyxus will tell you that a tool nobody has decided on is being used
by 400 people. It will not decide it for you, and it will not approve or block
a tool on your behalf.

The same applies to the framework mappings: they are a suggested mapping for
your auditor to confirm, not an assessment, and the console says so on the
page.

It does not infer a person from a machine

A device is linked to a person only when your identity map says so. Until
then, findings sit against the device. Nyxus will not guess from a username,
a hostname or a login pattern, because a guess that is wrong about who used a
personal account is worse than no answer.

It does not tell you who to discipline

Two things it will never infer, and they are worth stating plainly: that
somebody did something wrong, and that an account nobody can name belongs to
somebody in particular. What the product produces is a finding with evidence
attached and a place to record what you did about it.

It is not multi-tenant SaaS

It is your deployment, in your network, reading your log store. One deployment
can hold several companies - see Companies - but that is your
group structure, not other customers.

Nothing is sent to us except the subscription check, and the security guidance
sets out exactly what that contains.