Your estate datanever reaches us.
Nyxus runs in your own infrastructure. Findings, devices, people and tool names stay there. The subscription check is separate from estate data.
The overview is one A4 page for security review and procurement. We’ll also complete your questionnaire, in whatever format you use.
One request leaves.Your data doesn’t.
The receiver makes one HTTPS GET to the registry every six hours. It carries exactly three parameters, plus a random per-install deployment ID. Hover over or tap a parameter.
Who, what, where.Never what was said.
A finding records that an AI tool is in use, where and by whom. It never records what anybody did with it.
- Tool namescollected
- Usernamescollected
- Account domainscollected
- Device serialscollected
- Evidence pathscollected
Message contentneverFile contentneverCredentialsnever
The portal joins observations into a more sensitive picture: “this person uses these six tools across these three machines, two on personal accounts”. That picture is more sensitive than any single finding, which is why the portal authenticates.
The identity map associates named people with machines. It is supplied by the deployer, rather than derived, and deserves the same care as the log store.
In your cluster.For as long as you say.
Nyxus is self-hosted. It writes findings to your log store and reads them back, and keeps no copy of its own. Retention is yours to set.
Findings. Nyxus reads them back and never keeps its own copy. They are kept as long as your log store keeps them.
Decisions, credential hashes, integration secrets, the discovery queue and the audit trail. Never a finding. Estate history is kept for 400 days by default; the audit trail is never deleted. Encrypted at rest by your storage class.
Under a key you generate and hold outside the cluster. Without a key, nothing is backed up.
Nothing from your estate. It receives only the licence check above: no findings, no telemetry, no usage data.
Every change recorded.Nothing deletes it.
The portal is where the joined-up picture lives, so it authenticates, and every change made through it is recorded.
Distinct kinds of event. Every action that changes the deployment is recorded.
Never secrets. That is enforced where each entry is written.
Nothing in the product deletes from it. Exports are CSV, capped at 20,000 rows: a truncated export that looks complete is worse than none.
A team-viewer account can read the trail and change nothing.
Verified offline.Patient through outages.
Licence keys are claims signed with Ed25519. No network call decides whether a key is genuine, and an air-gapped deployment reads its own key correctly.
Offline signature verification is distinct from the six-hourly subscription check and its grace period.
The last day before new findings and enrolments pause.
New findings and new enrolments pause after fourteen days.
Everything already collected stays readable. The portal keeps working.
A licence question should not take your estate offline before somebody has had a chance to answer it.
Signed and pinned.Check before you install.
Every image and the chart are signed with cosign and carry an SBOM. The chart pins both images by digest for its release, so moving a tag cannot swap the bytes underneath an install.
Signing does not use a public transparency log; the signature is still verified against the key. Obtain the published image-signing public key, save it as nyxus-images.pub, and sign in to the registry as for an installation.
Replace RELEASE with the release you are verifying. The flag skips the transparency-log lookup; it does not skip verification of the signature against the key.
cosign verify --key nyxus-images.pub --insecure-ignore-tlog=true \ registry.nyxus.co.uk/nyxus-enterprise/receiver:RELEASE cosign verify --key nyxus-images.pub --insecure-ignore-tlog=true \ registry.nyxus.co.uk/nyxus-enterprise/charts/nyxus:RELEASE
What we don’t claim.Said before you ask.
Nyxus is a small, self-hosted product and says so rather than implying otherwise. These are the limits a security review should know about up front.
Found something?
Tell us first.
Email support@nyxus.co.uk with “security” in the subject; it is read before anything else in that mailbox. Say what you did, what happened and what you expected. A proof of concept helps, but a clear description matters more.
No PGP key is published. If something should not sit in a mailbox in the clear, send a first mail with no detail and we will agree a channel.
Take it to review.We’ll fill in the rest.
The security overview is one A4 page for security review and procurement. We’ll also complete your questionnaire, in whatever format you use.