Sovereign, regulated, or fully air-gapped - with every answer auditable down to the engine, the inputs, and the assumptions that produced it.
Deployment is cloud-agnostic - your preferred provider and region, sovereign delivery through Moro Hub in the UAE, or fully offline and air-gapped inside your walls - agreed in the Order. Hosted on AWS by default.
The model layer is your choice as well. Nexus is model-agnostic by architecture - a frontier model in the cloud or an approved local model inside your walls - and because the language layer never calculates, the figures and their receipts are identical either way.
In sovereign and regulated markets, these are not preferences - they are procurement gates. Nexus passes them by design.
Access is role-based by design - what a user can ask, see, and export is scoped to their role, and the audit trail records who saw what.
In-jurisdiction delivery where the data may not leave - including ISO 27001-certified, PDPL-aligned sovereign cloud infrastructure in the UAE as one worked example of a jurisdiction-agnostic pattern.
Fully disconnected deployment for the environments that require it. The whole trust stack - receipts, refusal, audit export - travels with it.
TLS 1.2 or higher in transit; industry-standard encryption at rest. (DPA, Schedule C.)
Role-based access on least privilege, multi-factor authentication for systems handling personal data, periodic access reviews and revocation. (DPA, Schedule C.)
Client data is never used to train or fine-tune models made available to third parties without prior written consent - contractually, not as policy. (Platform Terms §6.2; DPA §3.3.)
Processing region is set in the Order - jurisdiction-specific and sovereign delivery available; the contractual default is the United States. Subprocessors are listed, flowed-down, and change-notified with an objection right. (Platform Terms §6.3; DPA §6.)
Confirmed security incidents notified without undue delay - and in any event within seventy-two hours - with the information you need for your own obligations. (Platform Terms §6.5; DPA §5.2.)
Annual client audit via independent auditor, satisfiable by recognized third-party reports and written security summaries. (DPA §5.3.)
In a generative system, the model that talks is the model that answers - and it cannot tell you when it is wrong. In Nexus, the AI that talks never does the math:
The language model routes and narrates; named, versioned engines compute every figure. No figure returns without a bound engine result behind it.
Unverifiable inputs are refused, with the reason - and the refusal is logged like any other result.
Same inputs and engine version, identical figures - so any answer can be re-run and checked months later, in front of an auditor.
Every session exports engines, inputs, assumptions, and figures - a package your own statisticians can check, line by line.
Nothing changes silently: every answer records which engine version ran. Draft engines are born quarantined and promoted by a person.
Who asked what, answered from which data, when - role-based to the engine and dataset level, with source and vintage on every input.
Nexus runs on infrastructure certified to ISO 27001, SOC 1, SOC 2, and SOC 3 (AWS), with equivalently certified sovereign options. Rebirth's own technical and organizational controls - encryption, access control, network security, incident response, vendor management, personnel, and vulnerability management - are documented contractually in the DPA's security schedule and open to client audit. The commitments live in the contract, not the brochure.
GDPR Article 28 terms with SCCs (Module 2) incorporated, CCPA/CPRA service-provider restrictions, UAE PDPL coverage, and the security schedule.
Acceptable use, prohibited and high-risk data categories defined up front, uptime and support, subscriber data ownership.
Confidentiality, IP, export controls, sanctions and anti-corruption compliance across the engagement.
What we collect on this site, how long we keep it, and the rights you have - including that we do not sell or share personal information.