Security

What we don't do

• No bank account access, in this version of the product.
• Nalexi never initiates or moves a payment.
• Nalexi never receives your recovered funds — supplier refunds and credits go directly to you.
• Nalexi never contacts a supplier about a finding without your explicit approval.
• Nalexi never trains shared models across customers using your data.

Tenant isolation

Every customer-owned record is scoped to your workspace and every access path checks workspace membership before returning data. A user in one workspace cannot read, list, or reach another workspace's audits, findings, recovery cases, files, or billing records via the API.

File handling

• Only CSV and XLSX are accepted; file type is verified by content signature, not filename.
• Spreadsheet formulas are never executed — cached values are read, formulas are never evaluated.
• Raw files are stored privately and served only via short-lived, signed, expiring URLs.

Access control

• Multi-factor authentication is required for workspace owners and admins.
• Sensitive actions (raw-file download, full findings export, sending a supplier claim) require a recently re-verified session.
• Role-based permissions gate every write action server-side, not just in the interface.
• Support access to your workspace is off by default. When granted, it is time-limited, reason-logged, and auditable.

Recovery controls

• Every supplier claim requires your explicit approval before sending.
• Supplier contact details are never scraped or guessed — you confirm them, and a changed contact requires re-confirmation.
• A claim can never introduce new bank/payment details.
• You only pay a fee after a Verified Recovery Event — never on a supplier's acknowledgement or promise.

AI usage

Whether a payment is duplicated, and whether money is recoverable, is decided by deterministic rules — never by a language model. AI, where used, is limited to assistive tasks such as drafting suggestions, and never determines financial outcomes.

Status

Nalexi is in controlled pilot. We do not claim third-party security certifications we do not hold. If you need specific compliance documentation for your own due diligence, contact us and we'll tell you plainly what is and isn't in place today.