Security is not a layer. It is a condition for operating.

An AI agent with a connected tool is a user with a credential. That is why NEXTNOVA treats every agent the way it treats every person: identity, permission, approval and record — with controls that produce evidence as a consequence of the work.

Four layers, active for every company.

Identity and access

• MFA (TOTP · RFC 6238): Second factor by authenticator app or email, with trusted devices for a set period.
• SSO (Google · Microsoft): Sign in with your company's Google or Microsoft account, when configured.
• RBAC per module (Roles per module): Each role sees and does only what it should, in each module.
• Login protection (Lockout · policy): Lockout after failed attempts and a password policy.

Data

• Per-company isolation (Multitenant): Each company operates in its own environment, with no data mixed between customers.
• Encryption (TLS · AES-256-GCM): Encrypted traffic and integration credentials encrypted at rest.
• Secrets that don't come back (Masking): A saved credential is never returned in full to the screen.
• Data out of training (No external training): Models run on AWS Bedrock and your data does not train third-party models.

Operations and continuity

• Audit logs (Record per action): Who did what and when, including what the AI agents did.
• Daily backups and DRP (Backup · DRP): Daily off-server backup and a recovery plan.
• Zero-downtime releases (Blue/green): Updates go up alongside the live version and only switch over after validation.
• Webhooks and API (REST · Webhooks): Integration via REST API and events sent in real time to your systems.

Privacy

• Recorded legal basis (LGPD · GDPR): Each contact carries its legal basis and proof of where it came from.
• Data subject rights (Export · delete): Export and deletion of personal data, with a trail.
• Opt-out respected (Consent): Anyone who asked not to be contacted receives no outbound messages.
• Verifiable signature (SHA-256 chain): Contracts signed with a chained trail that anyone can verify.

The AI assistant acts on your behalf. And it is recorded that way.

Each person generates their own key to connect Claude, Codex or any MCP client to NEXTNOVA. There are no shared keys and no actions without an owner.

1. You generate the key — In your profile, under Security. It is shown only once; the platform stores only the hash.
2. The assistant uses the key — Claude, Codex or another MCP client connects with it, with no password and no shared session.
3. The platform checks — It validates the key, its expiration and the scope set by the company before every call.
4. The action carries your name — The trail records the person who owns the key and the assistant that acted — not an anonymous bot.

• Stored only as a SHA-256 hash — not even NEXTNOVA sees the key after it is created
• Set expiration: an expired key stops working on its own
• Revoked by its owner at any time, without affecting colleagues' keys
• The AI reaches the modules, workflows and integrations connected to the company

The team uses the credential. No one sees the secret.

In Nextflow and AI Teams, what the team builds — flows and agent teams — belongs to the workspace, and so do the credentials. That is what keeps the process running when people change.

Workspace credential, not a personal one

The flow uses the account connected to the workspace. No one has to lend their own login.

Uses it, but can't see it

Members run with the credential; the secret stays encrypted and the screen only shows that it is configured.

Review on every publish

Publishing or republishing a flow goes through a security review — not just the first time.

New risk pauses the flow

If the flow starts handling sensitive data (ID documents, email, bank account), it stops until someone approves.

Separate personal space

Each person's drafts stay in their personal space, out of the team's reach.

Continuity

If the person who connected the account leaves, the process continues. If the key is revoked, the error appears clearly so another member can replace it.

Nothing goes live without passing security. And every day, again.

Every published flow has the data it uses classified and reviewed by whoever answers for security. Once approved, it keeps being watched: classification runs again every day, and any new sensitive data goes back to review before the flow continues.

1. Publish: Publishing or republishing a flow opens a review — not only the first time.
2. Classify the data: The platform identifies which data the flow reads and sends, and calculates its risk level.
3. Security review: Someone with the security profile approves or rejects, with the reason recorded.
4. Live: Only what was approved runs. The decision stays in the audit trail.

Data classes detected: Tax ID (CPF / CNPJ), Email, Phone, Address, Bank details.

Daily reclassification

Every day, at a time the company chooses, the data of every published flow is classified again. Flow started touching new sensitive data → Flow paused immediately → Back to the review queue → Only resumes once approved.

DLP: data loss prevention

Third-party personal data is masked in the response according to the company's policy. The original record stays with those who have access; the recipient sees only what is needed.

Review on every publish

If the flow changed, it goes through security again. An old approval does not cover a new version.

New risk pauses, not just alerts

A warning no one is required to handle protects nothing. The flow stops until someone decides.

Whoever answers for it decides

Approval sits with the security profile — not with whoever built the flow.

Evidence with no extra effort

Detected classes, risk level, decision, reason and date are recorded automatically.

Each risk with the control that addresses it.

Prompt injection has no definitive solution today. What exists is reducing the surface and limiting the damage — and anyone promising complete protection is selling what they don't have.

Prompt injection

A hostile instruction hidden in a message, document or page the agent reads.

Third-party content treated as data; tools with limited scope; human approval for risky actions.

Data leakage through context

Sensitive data goes out in a reply to someone else or to someone who shouldn't see it.

Isolated environment per company; internal articles out of the public agent's reach; third parties' calendars never enter the context.

Excessive autonomy

An agent with more permission than the task requires does what it shouldn't.

Tools declared per agent, step limit per conversation and configurable human approval.

Claims without execution

The agent says it scheduled or recorded something that never happened.

The engine checks the receipt of each action before letting the agent claim it did it.

Hallucination with consequences

A wrong answer stated with confidence becomes a decision.

Knowledge base with sources, cited data must have an origin, continuous quality evaluation.

Agent credentials

An agent using a person's password or a shared key; no one knows who acted.

Personal key per user, with individual expiration and revocation, and a workspace credential for processes.

Uncontrolled cost

AI usage grows without anyone noticing until the invoice arrives.

Monthly limit, alert at 90% and automatic block at the limit.

Governance without evidence

Policy on a slide, controls that depend on someone remembering to write it down.

Every control produces its own record: trail, versions, reviews and approvals.

The AI management standard, with the evidence ready.

ISO/IEC 42001 is the first certifiable international standard for artificial intelligence management systems. It doesn't ask for intent: it asks for evidence. On NEXTNOVA that evidence comes out of the work itself, and your company arrives at the audit with it ready.

• What it is: AI management system (AIMS) standard, from the same family as ISO 27001
• Published: December 2023, by committee ISO/IEC JTC 1/SC 42
• Certifiable: Yes, by an accredited body, with an audit cycle
• Applies to: Anyone who develops, provides or simply uses AI — including third-party AI

Clauses 4 to 10 — the auditable part

• 4. Context: Inventory of agents, models, tools and integrations in use, exportable in the evidence package.
• 5. Leadership: Named roles: workspace owner, admin, security reviewer and approver.
• 6. Planning: Flows classified by the sensitive data classes they touch, plus the impact assessment template ready to fill in.
• 7. Support: Every agent and pipeline change recorded: who changed it, when, with the previous version kept and restorable.
• 8. Operation: Controlled lifecycle: draft, review, publishing, versions and decommissioning.
• 9. Performance evaluation: Continuous monitoring of quality, cost and human intervention in every conversation.
• 10. Improvement: Quality findings become a correction plan, tested on a copy before going live.

Annex A — nine objectives, 38 controls

• A.2 AI policies: Model per area, usage limit and each agent's rules defined and versioned.
• A.3 Internal organization: Roles per module, security reviewer and approval channel.
• A.4 Resources: Data, tools, models and integrations of each agent declared in its own record.
• A.5 Impact assessment: Impact assessment template already filled in with the inventory, and security review by data class on the flows.
• A.6 Lifecycle: Testing before publishing, saved versions and rollback to the previous version.
• A.7 Data for AI: Knowledge base with sources, separation between internal and public content, recorded legal basis.
• A.8 Information for interested parties: The agent states what it doesn't know and hands off to a person instead of making things up.
• A.9 Use of AI: Human approval, step limit, guardrails and a trail of every tool call.
• A.10 Third parties: Models on AWS Bedrock by default, with no training on your data; the providers each agent uses appear in the evidence package. Integrations with encrypted credentials.

Ready for your certification — The platform generates the technical evidence ISO/IEC 42001 asks for and clearly separates what belongs to the platform from what belongs to your organization: AI policy, internal audit and management review. When the standard is revised, the platform's controls are revised with it.

Aligned with the leading industry standards.

• ISO/IEC 42001 (AI management): Controls and evidence for the AI management system.
• ISO/IEC 27001 (Information security): Access, encryption, logging and continuity.
• SOC 2 (Service controls): Security, availability and confidentiality with a trail.
• NIST AI RMF (AI risk): Govern, map, measure and manage.
• OWASP Top 10 LLM (Technical risk): Prompt injection, leakage and excessive autonomy.
• LGPD (Privacy · Brazil): Legal basis, data subject, export and deletion.
• GDPR (Privacy · Europe): The same rights for European data subjects.
• EU AI Act (AI regulation): Human oversight, documentation and monitoring.

Certification belongs to your organization; the platform delivers the controls and the evidence, and is reviewed with every update to the standards.

Frequently asked questions

Does my data train any AI model?

No. The agents run on AWS Bedrock models, and your data is not used to train third-party models.

How does the key that connects Claude or Codex work?

Each person generates their own key in their profile. It is shown only once, has an expiration date, can be revoked at any time, and every action taken with it is recorded in the owner's name.

If someone leaves the company, do the flows stop?

No. Nextflow and AI Teams credentials belong to the workspace, not the person. The process continues, and the person who leaves loses access.

Can one company's data appear to another?

No. Each company operates in an isolated environment, with its own data.

Does NEXTNOVA help my company get ISO/IEC 42001 certified?

Yes. Certification is granted to your organization by an accredited body. NEXTNOVA delivers the technical part ready: inventory, change history with authorship, human oversight, monitoring and an exportable evidence package, plus AI policy and impact assessment templates for your team to complete.

Can I limit how much the AI spends?

Yes. You set the monthly limit, get an alert when you reach 90%, and usage stops automatically at the limit.