NEXIOS REAL ESTATE PROJECT FINANCE — SECURITY OVERVIEW This document describes the actual architecture and controls behind NEXIOS Real Estate Project Finance, for use in your own vendor-risk review. It is a factual description, not a certification -- see "Certification status" below for exactly what that means. 1. TENANT ISOLATION Each institution that uses the Service is provisioned its own, fully separate Postgres database (a dedicated database branch), not a shared schema and not a shared table distinguished by a tenant-id column. A request is only ever connected to the one database belonging to the institution the signed-in user's own session resolves to; there is no query path in the application by which a bug in one query could return another institution's rows, because another institution's database is never opened in the same connection scope. The small set of platform-level data needed to run the service itself -- account identities, the institution directory, staff invitations, session records, and subscription/billing status -- lives in a separate control-plane database that holds none of your loan, draw, or covenant data at all. 2. PROVISIONING MODEL There is no public self-service signup. Every institution's access is provisioned directly by a Nexios operator, and that institution's own Admin user then invites their own staff. This reduces the risk of an unauthorized party creating a workspace in the first place, at the cost of a slower onboarding than a fully self-serve product -- a deliberate tradeoff for this buyer. 3. ENCRYPTION All traffic to the Service is encrypted in transit (HTTPS). The one most sensitive secret in the control plane -- each institution's own database connection string -- is encrypted at rest with AES-256-GCM using a dedicated key, never stored or logged in plain text. Passwords are hashed with bcrypt; the Service never stores a recoverable copy of a password. 4. ACCESS CONTROL AND SEGREGATION OF DUTIES Within an institution, access is governed by four hierarchical roles -- Viewer, Underwriter, Approver, Admin -- each a strict superset of the one below it. Draw approval specifically enforces maker-checker segregation of duties in code: the user who submits a draw request can never be the same user who approves it, regardless of role. Sessions are revocable server-side; a role change, a password change, or a staff removal immediately invalidates that person's active sessions rather than waiting for a token to expire on its own. 5. THE AI ASSISTANT IS OPTIONAL AND BOUNDED An in-app AI assistant (Anthropic's Claude) is available to help a signed-in user understand a project's own numbers. It is advisory only: it cannot submit a draw, cannot change an underwriting input, and cannot override the Service's own deterministic go/no-go screen, which remains the actual decision logic regardless of anything the assistant says. It is the one feature that sends project-level data outside Nexios's own infrastructure (to Anthropic, solely to generate a response to a specific question), and it can be disabled entirely for an institution that does not want that -- see the Privacy Policy's Subprocessors section for detail. 6. BACKUPS AND RECOVERY Each institution's database is hosted on infrastructure that retains point-in-time recovery history (currently up to 24 hours) independent of the application's own backup behavior, allowing recovery from an operational error such as an accidental bulk deletion, in addition to ordinary database durability guarantees. 7. SUBPROCESSORS Database hosting, application hosting, payment processing, and (only when used) the AI assistant provider -- see the Privacy Policy's Subprocessors section for the specific vendors and exactly what each one can access. No subprocessor outside that list receives Your Data. 8. SECURITY INCIDENT RESPONSE If you become aware of a suspected vulnerability or security issue affecting the Service, report it to sales@polyapps-ai.com. Nexios's commitment to notify an affected institution of a confirmed Security Incident, and the timeframe for doing so, is set out in the Data Processing Agreement (GET /api/saas/platform/dpa), §8. 9. CERTIFICATION STATUS Nexios does not currently hold a formal third-party security certification such as SOC 2 or ISO 27001. This document is Nexios's own good-faith, factual description of its actual architecture and controls, offered as the basis for your review in place of a certification at this stage. Nexios is open to completing a reasonable written security questionnaire and discussing a path toward formal certification as the customer base for this product grows.