Data Protection Command Center —
Live per-organization posture — content scans, matches, enforcement verdicts and open incidents. Behaviour is driven by your org policy & settings.
Enforcement verdicts scans
Detection & Content Analysis M02
The shared detection engine every channel calls. Paste or type content to inspect it against the data-identifier library — real checksum validators (Luhn, Verhoeff, IBAN mod-97, GSTIN) cut false positives. Matched values are masked.
Scan content
Data-Identifier Catalog —
The generator-driven identifier library — India-first (Aadhaar, PAN, GSTIN, UPI, ABHA) plus global payment cards by network, IBAN per country, provider credentials/secrets, phones per country code, EU VAT, and national IDs — each validated where a checksum exists. Tune any identifier per-org (enable/disable, change its action) or add your own custom identifiers below.
Custom identifiers —
Define org-specific patterns (employee codes, project IDs, internal account formats). Stored per-org; catastrophic-regex and unknown-validator definitions are rejected server-side.
| Identifier | Regex-backed | Action | State | |
|---|---|---|---|---|
| No custom identifiers. | ||||
Identifiers per-org tunable
| Identifier | Category | Region | Validated | Action | Enabled |
|---|---|---|---|---|---|
| Loading… | |||||
Change an action or disable an identifier for this organization — overrides apply to every channel immediately.
Data Discovery M01
Classify a data store's contents into a sensitive-data inventory — what's where, which identifier categories, auto-applied sensitivity label, owner, and ROT (redundant / obsolete / trivial) so you can remediate and defensibly delete. Connectors stream items to the scanner; only categories, labels and a dedupe hash are stored — never the content. A DSAR search locates everything attributable to a data subject.
Scan items into the inventory
Paste items as JSON ([{"id","name","owner","content"}]) or one id|owner|content per line. In production a connector (file share / M365 / DB / bucket) streams these.
DSAR — data-subject access search
Sensitive-data inventory —
| Store | Item | Owner | Categories | Sensitivity | Label | ROT |
|---|---|---|---|---|---|---|
| No items scanned yet. | ||||||
Aria M15 · Copilot
Ask about incidents, insider risk, compliance coverage, why something was blocked, evidence, or discovery — Aria answers only from your live Nexus DLP data and shows the records it used, never a guess. Automated response playbooks turn a detection into an ordered, guarded set of actions (open incident, raise severity, seal evidence, notify, mask) — previewed as a dry run, then executed under your own permissions.
Ask Aria
Response playbooks —
A playbook = a trigger (policy-grammar condition) + ordered steps from a fixed action vocabulary. Actions execute under the runner's RBAC, so a playbook can never exceed your rights.
| # | Name | Steps | Enabled | |
|---|---|---|---|---|
| No playbooks yet. | ||||
Evidence Vault M14 · WORM/BYOK
A write-once, append-only vault of masked evidence, chained so any edit or reorder is detectable. Every record is envelope-encrypted: a per-record key encrypts the payload and is wrapped under your own tenant key (BYOK) — a database leak is useless without it, and destroying the key crypto-shreds the record without rewriting history. Legal hold blocks destruction; retention governs the rest.
Bring-your-own-key (BYOK)
Set your own tenant key — existing records are re-wrapped to it (ciphertext untouched). Stored only wrapped under the server master; we never hold your key in the clear.
Sealed evidence —
| Seq | Kind | Ref | Sealed | Legal hold | State |
|---|---|---|---|---|---|
| No evidence sealed yet. | |||||
Trust & GA readiness M18 · SOC2/ISO27001
Maps the platform's live technical controls — tamper-evident audit, enforced RBAC, BYOK-encrypted evidence, retention, the GENUINE deploy gate, incident lifecycle — to the SOC 2 Trust Service Criteria and ISO/IEC 27001:2022 Annex A, grading each from a real runtime signal and naming the artefact that evidences it. Evidence mapping and readiness only; certification requires an independent auditor and organisational controls outside this platform.
Control evidence
| Control | Status | SOC 2 | ISO 27001 | Evidence |
|---|---|---|---|---|
| Generate the report to see live control evidence. | ||||
Workflow E2 · SLA/DSAR/Holds
Operate the case lifecycle: incident SLA against your per-org targets, data-subject-access requests with statutory deadlines, and eDiscovery legal holds over the evidence vault.
DSAR cases
| # | Subject | Type | Reg | State | Deadline | |
|---|---|---|---|---|---|---|
| No DSAR cases. | ||||||
Legal holds (eDiscovery)
| # | Matter | Held records | State | |
|---|---|---|---|---|
| No holds. | ||||
Reports E3
Define reports from live platform data (incidents, compliance coverage, discovery, trust) and render them for preview or a scheduled run. Numbers come only from your data — never fabricated.
Report definitions
| # | Title | Sections | |
|---|---|---|---|
| No reports defined. | |||
Users & roles C2 · IAM
Manage who can use Nexus DLP in this organization and what they can do. Roles are enforced server-side; you can only grant roles at or below your own authority, and seat quota follows the org's licence tier. SSO/SCIM keeps this in sync with your IdP.
Add / update a user
Users —
| Username | Roles | Source | Active | ||
|---|---|---|---|---|---|
| No users yet. | |||||
Tenancy & platform C3 · MSSP
Operate the platform: tenant lifecycle, licence tier + seat quota + module entitlements, and live platform health.
Organizations —
| Tenant | Name | Status | Tier | Seats | Modules | |
|---|---|---|---|---|---|---|
| No tenants. | ||||||
Exact & Indexed Data Match M02 · EDM/IDM
Fingerprint your own records and documents so the engine detects them leaking — without ever storing the raw data. Exact Data Match keeps only a per-dataset salted hash of each field; Indexed Document Match keeps only shingle hashes. A provisioned dataset enforces its own action on every channel, regardless of the org default mode.
Exact Data Match — structured records —
Paste records one per line, fields comma-separated (e.g. Name,Email,Phone,Account). Only salted hashes are stored — the raw records are discarded immediately after indexing.
| # | Dataset | Records | Min fields | Action | Created | |
|---|---|---|---|---|---|---|
| No datasets indexed. | ||||||
Indexed Document Match — unstructured documents —
Paste a sensitive document; the engine fingerprints it into overlapping shingle hashes and detects partial copies or excerpts. The document text is discarded after fingerprinting.
| # | Document | Shingle k | Action | Created | |
|---|---|---|---|---|---|
| No documents fingerprinted. | |||||
Policy Management M12
Channel-agnostic policies — write once, enforce on endpoint, network, cloud, email and GenAI. Monitor policies audit only; enforce policies act. Conditions are evaluated server-side; every change is versioned.
Default posture
Policies —
| Policy | Channels | Identifiers | Mode | Action | Ver | State |
|---|---|---|---|---|---|---|
| Loading… | ||||||
Select a policy to see its conditions and version history.
Incidents M14
Policy violations become incidents with derived severity, masked evidence (redacted by default) and a governed lifecycle. Select an incident to work it: transition state, assign, and read the timeline.
Incidents —
| # | Severity | Channel | Actor | Identifiers | Status | Opened |
|---|---|---|---|---|---|---|
| No incidents yet — detections that warrant action open incidents here. | ||||||
Insider Risk M11 · UEBA
Per-actor behavioural risk scored from DLP activity — block and warn rates, bulk egress, and channel spread. When an actor crosses the org escalation threshold, their next action is automatically raised one level (allow→warn→block). Scores update live as agents ingest content.
Highest-risk actors —
| Actor | Risk | Band | Events | Blocks | Bulk | Updated |
|---|---|---|---|---|---|---|
| No actor activity yet — risk accrues as agents ingest content. | ||||||
Data Security Posture M10 · DSPM
Register the data stores your organization holds — databases, buckets, shares, SaaS repositories — and Nexus scores each one's posture (0–100, higher is worse) from exposure, data sensitivity, open findings and encryption at rest, grading A–F. Prioritize remediation by the worst grades.
Register a data store
Registered stores —
| Store | Type | Exposure | Sensitivity | Findings | Encrypted | Posture | Grade | |
|---|---|---|---|---|---|---|---|---|
| No data stores registered. | ||||||||
Data Lineage M10
Trace where sensitive data flowed — downstream (where it went: exports, USB, email, uploads) or upstream (where it came from). Edges are recorded as data is copied, transformed, exported or egressed; trace any node to see every place the data reached and which identifier categories travelled with it.
Record a flow edge
Trace a node
Recent flow edges —
| Source | → | Destination | Op | Labels | When |
|---|---|---|---|---|---|
| No flow edges recorded. | |||||
SaaS Security (CASB) M07
Discover the SaaS apps in use from the access logs you already have, separate sanctioned from shadow IT, see which are Generative-AI tools, grade each app's posture, govern third-party OAuth grants, assess each SaaS tenant's security posture (SSPM), watch for cloud threats, and decide access adaptively. Sanctioned/tolerated lists, the shadow-IT inline action, GenAI control and all thresholds are set in the Admin area; platform guardrails in the Super User area. Cloud activity is scanned by the same Nexus detection engine and raises incidents here.
Shadow-IT discovery from access logs
Paste forward-proxy / NGFW / SASE egress log lines. Squid, common/combined (CLF), CSV and JSON-lines are auto-detected; each discovered app is classified and posture-graded from the built-in catalog.
Register / classify an app
Discovered apps —
| App | Status | Category | Posture | Grade | Users | Traffic | Last seen | |
|---|---|---|---|---|---|---|---|---|
| No apps discovered yet. | ||||||||
Third-party OAuth grants —
Score an app's requested scopes and get the governance decision — allow / review / revoke — factoring the publisher and user reach.
| App | Actor | Scopes | Users | Risk | Band | Decision |
|---|---|---|---|---|---|---|
| No OAuth grants recorded. | ||||||
SSPM — SaaS posture —
Assess a SaaS tenant's security configuration against the provider baseline (MFA, external sharing, legacy auth, admin sprawl, audit logging, …). Edit the config snapshot and assess; findings carry remediation.
| Provider | Grade | Pass | Failing | Assessed | |
|---|---|---|---|---|---|
| No SSPM assessments yet. | |||||
Cloud threats —
Impossible travel, mass download/share bursts, OAuth spikes and exfil to shadow apps — detected over SaaS activity and rolled into insider-risk. Thresholds are per-org (Admin area).
| Type | Actor | Severity | Detail | Detected |
|---|---|---|---|---|
| No cloud-threat alerts. | ||||
Adaptive access simulator
Combine app posture, the actor's insider-risk band, content sensitivity and session context into one access decision — allow / monitor / step-up / limited / block — the most restrictive any signal warrants.
Agents & Channels M04/M06/M08
Endpoint, browser and email agents enroll here and authenticate with a short-lived service token. Each sends content through the same /v1/ingest engine and enforces the returned verdict locally.
Enroll an agent
Enrolled agents —
| Agent | Host | Platform | Version | Status | Last seen |
|---|---|---|---|---|---|
| Loading… | |||||
Compliance M16
How far your active enforcing policies cover each regulation's controls — India DPDP Act 2023, RBI/SEBI financial data, and PCI-DSS v4.0. Apply a pack to seed the recommended enforcing policies.
SIEM Export M17 · OCSF
Stream detection events to your SIEM or data lake as OCSF Data Security Finding (class 2006) over signed webhooks, or pull them on a schedule. Only ids and masked samples are emitted — never a raw value.
Add a webhook sink
Sinks —
| # | URL | Format | Enabled | |
|---|---|---|---|---|
| No sinks configured. | ||||
Recent events as OCSF preview
—
Admin Area —
Organization settings for —. Behaviour is data — these drive the detection engine and enforcement for this org. Secrets are encrypted at rest and never shown back.
Detection & response settings
Live connectors
Provision M365 email, incident notifications and other channels for this organization. Credentials are encrypted at rest; the browser only ever sees whether a secret is set.
Audit ledger —
Append-only and hash-chained — every sensitive action is recorded and the chain is cryptographically verifiable.
Super User Area platform
Platform-wide defaults and guardrails that cascade to every organization, plus the organization directory. These apply across all tenants unless an org overrides an admin-area setting.
Platform defaults & guardrails
Organizations —
| Tenant | Name | Kind | Status |
|---|---|---|---|
| Loading… | |||