This policy explains how Oqio Inc. (“Oqio”, “we”) handles personal data in the Nexus security platform, including the Nexus web console and the Nexus mobile app for iOS and Android. Nexus is sold to organizations. If you use Nexus through your employer, your organization is the controller of the security data in its tenant and we process it on their instructions.
Data we collect
Account identity. When you sign in, our authentication provider supplies us with your name, email address, and a unique user identifier. Nexus accounts are created by your organization’s administrators; the mobile app does not offer account registration.
Session credentials. The mobile app stores a short-lived session token in the operating system keychain or keystore. It is sent to our API to authorize requests and is removed from the device when you sign out.
Organization security data. Nexus displays the telemetry your organization’s deployment produces: security alerts, risk assessments, investigations, and the endpoints enrolled in your tenant, including hostname, operating system, architecture, agent version, last check-in time, and resource utilization. The mobile app reads this data; it does not generate or modify it.
What the mobile app does not collect. The app requests no access to location, contacts, photos, microphone, or camera, contains no advertising or analytics SDK, and does not collect an advertising identifier. We do not track you across other companies’ apps or websites.
How we use data
We use account identity and session credentials to authenticate you, to resolve which organization’s data you are entitled to see, and to keep the service secure. We use organization security data to provide the service to your organization — detecting and surfacing threats, scoring risk, and supporting investigations.
We do not sell personal data, and we do not use it for advertising or for automated decisions producing legal effects.
Who we share data with
Clerk provides authentication and holds the account identity described above.
Expo distributes over-the-air updates to the mobile app. When the app checks for an update it contacts Expo’s servers, which receive the request’s network metadata and the app’s build identifiers. No Nexus account or security data is sent.
These providers process data on our instructions under contract. They are not permitted to use it for their own purposes. We do not sell personal data, and we do not share it with third parties for their own advertising or marketing purposes.
Security
All traffic between the mobile app and our API is encrypted in transit with TLS. Every request carries a bearer token scoped to your session, and the API resolves your organization from that token rather than from anything the client asserts, so one tenant cannot request another’s data. Session tokens on mobile devices are held in hardware-backed secure storage where the device provides it.
Retention and deletion
We retain account identity for as long as your Nexus account is active. Organization security data is retained for the duration of your organization’s contract with us, or as otherwise agreed in that contract. When an account or organization is deleted, we delete or anonymize its personal data within 30 days, except where we must retain records to meet a legal obligation.
Your rights
Depending on where you live, you may have the right to access, correct, export, or delete your personal data, to object to or restrict processing, and to lodge a complaint with a supervisory authority. To exercise any of these, or to request deletion of your account and its associated personal data, write to support@oqio.com. If your account was created by your employer, we may direct your request to them as the controller of that data.
International transfers
We operate infrastructure in The Commonwealth of Massachusetts, USA. Where personal data is transferred out of your home jurisdiction, we rely on appropriate safeguards, including standard contractual clauses where required.
Children
Nexus is enterprise software and is not directed to children. We do not knowingly collect personal data from anyone under 16.
Changes
We will update this policy as the service changes and will revise the effective date above. Material changes will be communicated to the administrators of affected organizations.
Contact
Oqio Inc., 867 Boylston Street, 5th Floor, Boston, MA 02116, USA. Phone: +1 202 948 7584. Privacy enquiries: support@oqio.com. This policy is governed by the laws of The Commonwealth of Massachusetts, USA.