The mechanisms behind confidentiality and security.

This page describes the mechanisms behind every claim that appears elsewhere on the site. Each section names one mechanism and shows where it lives in the pipeline. None of it is policy with no implementation underneath.

The short version. The respondent’s voice is replaced with a synthetic one before anything is stored. Every quote that leaves the system was something the person actually said. The interviewer is audited on every conversation. The data path enforces tenant isolation at the row and node level. The customer owns the tenant. Anthropic and ElevenLabs run under no-training and no-retention contracts. In accordance with Anthropic’s usage policy and compliance, we do not work on military applications, and we will not help anyone re-identify a respondent.

The respondent’s audio runs through ElevenLabs under Zero Retention Mode, which deletes the provider-side copy after the call. Entity stripping happens before that transcript ever leaves the client’s perimeter. A proxy inside the client’s own tenant removes blacklisted names, evocations, and person identifiers against a list the client controls. Nexa does not hold that list and does not see the original transcript. The boundary is enforced by the client owning the proxy, so our own staff sit outside it.

Audio retention is set per deployment. A client running a public audit or a contest keeps the recording, because that use case needs it. A client whose policy forbids retained voice is configured so the audio never reaches any system we operate. In that configuration, re-identification by voice has nothing to work from, because no recording was kept.

Where an anonymized audio record is wanted, the cleaned transcript is regenerated as a fresh synthetic voice. The same data-minimization design runs in HIPAA-grade configurations without bespoke compliance work on the capture layer.

Every quote that leaves the system is a literal substring of a real USER turn from a real interview. A deterministic filter verifies this before persistence. When the filter detects an invented quote, it deletes the quote rather than rewriting it. A separate cross-contamination check verifies that perception-mapping outputs do not contain entities the respondent never mentioned. When the check fires, the affected fields are cleared and flagged.

Cleaned, shortened, and translated display layers are all derived from the original verbatim. No step introduces new words. The source-language verbatim is never translated. It stays in its original language as the provenance record.

Every claim in every report links back to the transcript that produced it through a chunk identifier of the form transcript_id / turn_id / sentence_id. The link is always present, on every conversation, with no sampling. The same property holds at fifty interviews and at fifty thousand.

Our AI conversation agent is built with a behavior tree, protocol enforcement rules, knowledge domains, and per-agent guardrails, all defined in a versioned specification. The audit runs separately, by an independent audit agent that grades the interview agent against six protocol KPIs on every single interview: context delivery, profile coverage, brand-perception coverage, no re-asking, neutrality, and graceful close.

The protocol specification that configures the agent is the same document the auditor uses as a reference. Both sides ground in the same source, so the audit cannot quietly drift away from the protocol it is measuring. A conversation with poor execution has its intelligence discounted in the composite score.

We have not found another platform in the category that audits its own instrument per conversation.

Before any agent reaches a real respondent, Claude takes the role of a simulated respondent and runs our adversarial attack library against the interview agent at scale. The library covers deliberate confusion, fake-data injection, signal burying, and brand-confusion attacks. The agent has to catch the manipulation and surface the real signal. The library ships with the platform. The client extends it with the patterns specific to their domain.

Hard failures block deployment. Soft failures become production monitors. For every soft-failure pattern, the system watches whether the same class of failure surfaces in real conversations. When it does, any intelligence traced to that moment is excluded from the compiled output.

When a client domain expert tells the system that an interpretation is wrong in their context, the system finds every conversation in the corpus that matches that context and re-pipelines them. It re-analyzes, re-tags, and re-weights every match. The expert’s correction propagates across the entire historical corpus. The audit trail keeps every prior interpretation alongside the new one, so neither the old nor the new is lost.

There are two surfaces for making a correction. The first is a dashboard annotation: the expert sees the AI’s interpretation, the source verbatim, and the methodology, and overrides where needed. The second is the interview agent directly, in voice. The expert talks to the agent as a coaching surface, and the refinement enters the same correction loop.

The same loop calibrates the half-lives. Brand-perception facts decay in weeks. Training-gap facts only decay when the training catalog changes. We ship a baseline calibrated over two years of work. The Expert-in-the-Loop tunes it for the vertical.

Security is enforced by the data access path itself. There is no separate policy layer between the request and the data. Every session ticket carries a security scope. That scope cascades into which MCP tools the calling LLM can see, which nodes in the graph it can traverse, which rows in the fact store it can read, and which verbatim chunks resolve when it cites.

An unauthorized request is not denied with an error. Instead, the unauthorized data is invisible to the caller. A bad actor inside a privileged tool sees the data their scope allows. They cannot see beyond it, and they have no signal that anything was hidden.

Concretely: an Excel user calls our MCP with their OAuth session ticket. The ticket is minted with their scope. From that scope, the system filters the tool list visible to the LLM, filters graph traversal at the node level, filters Postgres reads at the row level, and resolves citations only for chunks in scope.

Every deployment runs inside the client’s own tenant. The default substrate is Cloudflare, meaning the client’s own Cloudflare account. We set it up. They own it. AWS, Azure, and on-prem follow the same model on a different vendor. The capture pipeline, the cleaned transcripts, the bi-temporal knowledge layer (built on the Zep and mem0 temporal model, with Apache AGE on Postgres as the graph implementation), the fact store, the dashboards, and the AI agents all live on infrastructure the client controls.

The schema is open. The corpus is portable. The bi-temporal model lets the client replay the state of their corpus as of any past date, compare against today, and audit the methodology’s evolution over time. If Nexa Intelligence shut down tomorrow morning, the client keeps operating without interruption.

The customer’s enriched corpus is the product. It does not flow into model training. Every plan uses the Anthropic no-training contract by default. Enterprise additionally uses the no-retention contract: no LLM customer data persists at the model provider beyond the request. Voice runs no-retention on every plan and every tier, with ElevenLabs.

The distinction matters. Voice is no-retention on every account. The LLM layer is no-training on every account and no-retention on Enterprise. All of these properties are in signed contracts before any data flows.

We do not refuse the strategic decisions our clients make on the basis of aggregate intelligence. Closing stores, restructuring business units, redesigning roles: these are decisions the operator was already in a position to make. The corpus exists to inform them. We do not editorialize the use of intelligence the client paid to capture.

Individual re-identification is a separate question. The system was not built to recover who said what. Recovering it would be an architectural failure and is not in any list of permitted use cases.

The things we refuse:

• ×Military applications.
• ×Surveillance of named individuals. Any OAuth scope that would enable it is rejected before any data flows.
• ×Re-identification of respondents. The Security Cascade and the Voice Substitution chain leave no usable handle to attempt it from.
• ×Selling raw transcripts to third parties.
• ×Training third-party LLMs on customer data.
• ×Synthetic-respondent augmentation passed off as real capture.

Nexa Intelligence was built inside ACET, the technology incubator at Université de Sherbrooke. The behavioral interaction protocol behind our AI conversation agent was developed in collaboration with the CEL research program, grounded in a 4,000-interview behavioral study of human-AI conversational dynamics.

Each property on this page comes from a specific design choice. The voice pipeline has no place to retain a print. The hallucination filter runs inline against the cleaned transcript. The enrichment audit log is append-only. The interviewer audit runs as a first-class step in the protocol. The security cascade lives in the data access path. The system was built this way from the first deployment.