# NEXUS AI Security

NEXUS AI operational interfaces are authenticated and authorization-scoped. This documentation service is public because it contains product and interface metadata; it does not expose deployment data or secrets.

## Authentication

The NEXUS MCP service supports OAuth 2.0 with PKCE for interactive clients. The GPT-compatible API supports NEXUS Bearer access tokens. Use the authentication method required by the specific interface.

## Authorization

Use least privilege. Separate read permissions from write and destructive permissions. Examples of useful boundaries include:

- `deployment.read`
- `deployment.logs`
- `deployment.create`
- `deployment.manage`
- `database.read`
- `database.write`
- `secrets.read`
- `secrets.manage`

High-risk operations such as deletion, secret writes, database writes, and restore should require explicit authorization and a narrowly scoped credential.

## Tenant controls

NEXUS AI isolates organizations, runtime networks, volumes, and object-storage buckets. Organization roles include Owner, Admin, and Developer. Enterprise configurations can use SAML or OIDC SSO and customer-owned cloud deployments where enabled.

The platform documents HIPAA-aligned safeguards for regulated environments, including tenant isolation, encrypted secrets and backups, scoped bucket IAM, audit logs, customer-owned cloud deployment, and BAA availability for eligible plans. Customers remain responsible for their application and compliance program.

## Encryption and audit

Secrets and bucket credentials use AES-256-GCM encryption at rest. Secrets are injected at container start and are not returned by secret-list operations. Platform actions are recorded in the audit trail for authorized administrators.

## Logging

Never log API keys, Bearer tokens, OAuth credentials, database passwords, secret values, or signed download URLs.

## Related resources

- [API](/docs/api.md)
- [MCP](/docs/mcp.md)
- [Backups](/docs/backups.md)