Data Protection Command Center —
Live per-organization posture — content scans, matches, enforcement verdicts and open incidents. Behaviour is driven by your org policy & settings.
Enforcement verdicts scans
Detection & Content Analysis M02
The shared detection engine every channel calls. Paste or type content to inspect it against the data-identifier library — real checksum validators (Luhn, Verhoeff, IBAN mod-97, GSTIN) cut false positives. Matched values are masked.
Scan content
Data-Identifier Catalog —
The generator-driven identifier library — India-first (Aadhaar, PAN, GSTIN, UPI, ABHA) plus global payment cards by network, IBAN per country, provider credentials/secrets, phones per country code, EU VAT, and national IDs — each validated where a checksum exists. Tune any identifier per-org (enable/disable, change its action) or add your own custom identifiers below.
Custom identifiers —
Define org-specific patterns (employee codes, project IDs, internal account formats). Stored per-org; catastrophic-regex and unknown-validator definitions are rejected server-side.
| Identifier | Regex-backed | Action | State | |
|---|---|---|---|---|
| No custom identifiers. | ||||
Identifiers per-org tunable
| Identifier | Category | Region | Validated | Action | Enabled |
|---|---|---|---|---|---|
| Loading… | |||||
Change an action or disable an identifier for this organization — overrides apply to every channel immediately.
Data Discovery M01
Classify a data store's contents into a sensitive-data inventory — what's where, which identifier categories, auto-applied sensitivity label, owner, and ROT (redundant / obsolete / trivial) so you can remediate and defensibly delete. Connectors stream items to the scanner; only categories, labels and a dedupe hash are stored — never the content. A DSAR search locates everything attributable to a data subject.
Scan items into the inventory
Paste items as JSON ([{"id","name","owner","content"}]) or one id|owner|content per line. In production a connector (file share / M365 / DB / bucket) streams these.
DSAR — data-subject access search
Sensitive-data inventory —
| Store | Item | Owner | Categories | Sensitivity | Label | ROT |
|---|---|---|---|---|---|---|
| No items scanned yet. | ||||||
Aria M15 · Copilot
Ask about incidents, insider risk, compliance coverage, why something was blocked, evidence, or discovery — Aria answers only from your live Nexus DLP data and shows the records it used, never a guess. Automated response playbooks turn a detection into an ordered, guarded set of actions (open incident, raise severity, seal evidence, notify, mask) — previewed as a dry run, then executed under your own permissions.
Ask Aria
Response playbooks —
A playbook = a trigger (policy-grammar condition) + ordered steps from a fixed action vocabulary. Actions execute under the runner's RBAC, so a playbook can never exceed your rights.
| # | Name | Steps | Enabled | |
|---|---|---|---|---|
| No playbooks yet. | ||||
Evidence Vault M14 · WORM/BYOK
A write-once, append-only vault of masked evidence, chained so any edit or reorder is detectable. Every record is envelope-encrypted: a per-record key encrypts the payload and is wrapped under your own tenant key (BYOK) — a database leak is useless without it, and destroying the key crypto-shreds the record without rewriting history. Legal hold blocks destruction; retention governs the rest.
Bring-your-own-key (BYOK)
Set your own tenant key — existing records are re-wrapped to it (ciphertext untouched). Stored only wrapped under the server master; we never hold your key in the clear.
Sealed evidence —
| Seq | Kind | Ref | Sealed | Legal hold | State |
|---|---|---|---|---|---|
| No evidence sealed yet. | |||||
Trust & GA readiness M18 · SOC2/ISO27001
Maps the platform's live technical controls — tamper-evident audit, enforced RBAC, BYOK-encrypted evidence, retention, the GENUINE deploy gate, incident lifecycle — to the SOC 2 Trust Service Criteria and ISO/IEC 27001:2022 Annex A, grading each from a real runtime signal and naming the artefact that evidences it. Evidence mapping and readiness only; certification requires an independent auditor and organisational controls outside this platform.
Control evidence
| Control | Status | SOC 2 | ISO 27001 | Evidence |
|---|---|---|---|---|
| Generate the report to see live control evidence. | ||||
Workflow E2 · SLA/DSAR/Holds
Operate the case lifecycle: incident SLA against your per-org targets, data-subject-access requests with statutory deadlines, and eDiscovery legal holds over the evidence vault.
DSAR cases
| # | Subject | Type | Reg | State | Deadline | |
|---|---|---|---|---|---|---|
| No DSAR cases. | ||||||
Legal holds (eDiscovery)
| # | Matter | Held records | State | |
|---|---|---|---|---|
| No holds. | ||||
Reports E3
Define reports from live platform data (incidents, compliance coverage, discovery, trust) and render them for preview or a scheduled run. Numbers come only from your data — never fabricated.
Report definitions
| # | Title | Sections | |
|---|---|---|---|
| No reports defined. | |||
Users & roles C2 · IAM
Manage who can use Nexus DLP in this organization and what they can do. Roles are enforced server-side; you can only grant roles at or below your own authority, and seat quota follows the org's licence tier. SSO/SCIM keeps this in sync with your IdP.
Add / update a user
Users —
| Username | Roles | Source | Active | ||
|---|---|---|---|---|---|
| No users yet. | |||||
Tenancy & platform C3 · MSSP
Operate the platform: tenant lifecycle, licence tier + seat quota + module entitlements, and live platform health.
Organizations —
| Tenant | Name | Status | Tier | Seats | Modules | |
|---|---|---|---|---|---|---|
| No tenants. | ||||||
Exact & Indexed Data Match M02 · EDM/IDM
Fingerprint your own records and documents so the engine detects them leaking — without ever storing the raw data. Exact Data Match keeps only a per-dataset salted hash of each field; Indexed Document Match keeps only shingle hashes. A provisioned dataset enforces its own action on every channel, regardless of the org default mode.
Exact Data Match — structured records —
Paste records one per line, fields comma-separated (e.g. Name,Email,Phone,Account). Only salted hashes are stored — the raw records are discarded immediately after indexing.
| # | Dataset | Records | Min fields | Action | Created | |
|---|---|---|---|---|---|---|
| No datasets indexed. | ||||||
Indexed Document Match — unstructured documents —
Paste a sensitive document; the engine fingerprints it into overlapping shingle hashes and detects partial copies or excerpts. The document text is discarded after fingerprinting.
| # | Document | Shingle k | Action | Created | |
|---|---|---|---|---|---|
| No documents fingerprinted. | |||||
Policy Management M12
Channel-agnostic policies — write once, enforce on endpoint, network, cloud, email and GenAI. Monitor policies audit only; enforce policies act. Conditions are evaluated server-side; every change is versioned.
Default posture
Policies —
| Policy | Channels | Identifiers | Mode | Action | Ver | State |
|---|---|---|---|---|---|---|
| Loading… | ||||||
Select a policy to see its conditions and version history.
Incidents M14
Policy violations become incidents with derived severity, masked evidence (redacted by default) and a governed lifecycle. Select an incident to work it: transition state, assign, and read the timeline.
Incidents —
| # | Severity | Channel | Actor | Identifiers | Status | Opened |
|---|---|---|---|---|---|---|
| No incidents yet — detections that warrant action open incidents here. | ||||||
Insider Risk M11 · UEBA
Per-actor behavioural risk scored from DLP activity — block and warn rates, bulk egress, and channel spread. When an actor crosses the org escalation threshold, their next action is automatically raised one level (allow→warn→block). Scores update live as agents ingest content.
Highest-risk actors —
| Actor | Risk | Band | Events | Blocks | Bulk | Updated |
|---|---|---|---|---|---|---|
| No actor activity yet — risk accrues as agents ingest content. | ||||||
Data Security Posture M10 · DSPM
Register the data stores your organization holds — databases, buckets, shares, SaaS repositories — and Nexus scores each one's posture (0–100, higher is worse) from exposure, data sensitivity, open findings and encryption at rest, grading A–F. Prioritize remediation by the worst grades.
Register a data store
Registered stores —
| Store | Type | Exposure | Sensitivity | Findings | Encrypted | Posture | Grade | |
|---|---|---|---|---|---|---|---|---|
| No data stores registered. | ||||||||
Data Lineage M10
Trace where sensitive data flowed — downstream (where it went: exports, USB, email, uploads) or upstream (where it came from). Edges are recorded as data is copied, transformed, exported or egressed; trace any node to see every place the data reached and which identifier categories travelled with it.
Record a flow edge
Trace a node
Recent flow edges —
| Source | → | Destination | Op | Labels | When |
|---|---|---|---|---|---|
| No flow edges recorded. | |||||
SaaS Security (CASB) M07
Discover the SaaS apps in use, separate sanctioned from shadow IT, grade each app's posture (certs, MFA, encryption, data residency, breach history), and score the risk of third-party OAuth grants by the scopes they hold. Sanctioned and tolerated app lists are set in the Admin area; everything else is shadow IT.
Register / classify an app
Discovered apps —
| App | Status | Risk | Posture | Grade | Users | Last seen | |
|---|---|---|---|---|---|---|---|
| No apps discovered yet. | |||||||
Third-party OAuth grants —
| App | Actor | Scopes | Risk | Band | Granted |
|---|---|---|---|---|---|
| No OAuth grants recorded. | |||||
Agents & Channels M04/M06/M08
Endpoint, browser and email agents enroll here and authenticate with a short-lived service token. Each sends content through the same /v1/ingest engine and enforces the returned verdict locally.
Enroll an agent
Enrolled agents —
| Agent | Host | Platform | Version | Status | Last seen |
|---|---|---|---|---|---|
| Loading… | |||||
Compliance M16
How far your active enforcing policies cover each regulation's controls — India DPDP Act 2023, RBI/SEBI financial data, and PCI-DSS v4.0. Apply a pack to seed the recommended enforcing policies.
SIEM Export M17 · OCSF
Stream detection events to your SIEM or data lake as OCSF Data Security Finding (class 2006) over signed webhooks, or pull them on a schedule. Only ids and masked samples are emitted — never a raw value.
Add a webhook sink
Sinks —
| # | URL | Format | Enabled | |
|---|---|---|---|---|
| No sinks configured. | ||||
Recent events as OCSF preview
—
Admin Area —
Organization settings for —. Behaviour is data — these drive the detection engine and enforcement for this org. Secrets are encrypted at rest and never shown back.
Detection & response settings
Live connectors
Provision M365 email, incident notifications and other channels for this organization. Credentials are encrypted at rest; the browser only ever sees whether a secret is set.
Audit ledger —
Append-only and hash-chained — every sensitive action is recorded and the chain is cryptographically verifiable.
Super User Area platform
Platform-wide defaults and guardrails that cascade to every organization, plus the organization directory. These apply across all tenants unless an org overrides an admin-area setting.
Platform defaults & guardrails
Organizations —
| Tenant | Name | Kind | Status |
|---|---|---|---|
| Loading… | |||