Skip to content
Security

Trust built into the canvas

Nexow is designed so power never means open access. Generated code runs sandboxed, credentials stay scoped, and your workspace history stays yours.

Security

Sandboxed widgets

Every generated widget runs in an isolated iframe with a strict boundary — it can render and fetch, not reach your account or other widgets.

Scoped credentials

Connector credentials are limited to the services you connect and the widgets that need them. Least privilege by default.

Workspace provenance

Versions, logs and generated source stay attached to your workspace history so you can inspect, roll back and audit what runs.

Sync you control

Cloud sync keeps workspaces available across devices without turning your canvas into someone else’s product.

Compliance

Audited against the standards enterprises ask for

Independent auditors assess Nexow against recognised security and privacy standards. Reports and certificates are available to customers and prospects under NDA.

  • SOC 2 Type II

    Certified

    An independent auditor tests our security, availability and confidentiality controls across an observation window, rather than on a single day.

  • ISO/IEC 27001

    Certified

    Our information security management system is certified against the international standard — risk assessment, access control, supplier management and incident response.

  • ISO/IEC 27017

    Certified

    The cloud extension to 27001: the controls that divide responsibility between Nexow, the infrastructure we run on, and your workspace.

  • ISO/IEC 27018

    Certified

    The cloud privacy extension: how personal data in a workspace is separated, handled, and returned or deleted when you leave.

  • GDPR

    Compliant

    A Data Processing Agreement, a published sub-processor list, data subject rights and breach notification timelines for everyone in the EU and UK.

GDPR is a regulation we comply with, not a certificate anyone issues — the entries marked certified are audits carried out by an accredited third party.

Request reports

What we commit to

  • Generated code never runs with unrestricted access to your account.
  • Private prompts, chat history and connection ids stay with the author.
  • Marketplace installs arrive paused or undeployed — the first run is always your choice.
  • Legal privacy details live in our Privacy Policy; this page is the product view.
Nexow

Read the fine print

Product architecture here; the Privacy Policy covers legal processing details.

Privacy PolicyContact us