The Zero Data Policy across the intelligence matrix.

Every operation in the intelligence matrix runs under a Zero Data Policy. On top of no training on customer data, an in-tenant deployment keeps every piece of information the system handles inside your own account. Data resides in your infrastructure. The LLM partner and the voice partner discard it after the call. In that configuration there is no Nexa-side copy.

The policy is built to the control requirements behind the frameworks customers ask about, such as HIPAA, SOC 2, Loi 25 Quebec, and GDPR. Because the platform runs inside your own audited infrastructure, those controls apply to the substrate you already certify. This page covers what the policy means per layer, what each partner sees, and what gets retained.

Every plan runs under the Anthropic no-training contract. Customer content does not enter Anthropic’s model training data. The contract is signed before any data flows. The constraint lives in signed paper rather than in a settings checkbox.

Enterprise plans additionally run the Anthropic Zero Retention Policy. Customer content sent to the model does not persist at Anthropic beyond the request. The model sees the prompt, returns the response, and the request and response are not retained on Anthropic infrastructure.

What Anthropic sees on each call: the rendered system prompt (a pipeline-version-locked template) and the transcript chunks the enrichment node was asked to process. Those chunks have already passed through the client-controlled proxy that strips blacklisted entities inside the tenant, so the model works on the cleaned transcript rather than the original. Anthropic does not see the raw recording or the pre-strip transcript.

Voice runs under the ElevenLabs no-retention arrangement on every plan and every tier. Under Zero Retention Mode the original respondent audio does not persist at ElevenLabs after the call: the provider deletes its copy, and a later read returns nothing. No training is performed on customer voice content.

What ElevenLabs sees on each call: the audio stream from the respondent during the live interview, and the cleaned transcript during the pass that regenerates an anonymized audio record. Whether a recording is kept on the client side is set per deployment. For a client whose policy forbids retained voice, the audio is configured never to reach storage, so no respondent voiceprint exists after the call.

The datalake holds the cleaned transcripts and the regenerated audio records. It sits in object storage on your account: R2 on Cloudflare, S3 on AWS, MinIO on premise, and Azure through an S3-compatible endpoint. Encryption at rest uses the platform provider’s default AES-256. In an in-tenant deployment there is no copy in any Nexa-controlled environment.

The datalake is append-only. The platform does not delete past entries. When a respondent revokes consent, the platform writes a tombstone that blocks downstream access to that conversation; see Respondent Sovereignty for the propagation mechanics. Consent capture and the revocation flow are wired into the client’s own interview integration, configured to their requirements.

The enriched fact store holds the typed intelligence extracted from the corpus: pain points, opportunity scores, brand-perception dimensions, competitor mentions, training gaps. Every row points back to the source transcript chunk through the chunk identifier. The store sits on your account, in Postgres or the equivalent cloud-native database.

The fact store is the artifact the platform produces. It is yours. We operate against it under contract; we do not export rows from it; we do not run training against it; we do not aggregate across customers.

The same data-minimization design runs in HIPAA-grade configurations without bespoke compliance work on the capture layer. For HIPAA deployments, the operating boundary is the Business Associate Agreement; the architecture is unchanged.

For SOC 2 Type II, the append-only audit trail, the secrets discipline, and the fail-closed checklist supply the evidence that auditors look for. Operator actions are logged in your account, where your security team controls access.

For Loi 25 Quebec deployments, storage and compute can be deployed to Canadian regions of the chosen cloud vendor. The consent flow at interview start, the tombstone mechanism on revocation, and the respondent-facing transparency record are configured per deployment to cover the substantive obligations.

For GDPR deployments, storage and compute can be deployed to EU regions. The data-subject access path uses the chunk-identifier provenance chain to locate every fact derived from a given conversation, and groups by respondent where the client supplies a pseudonymous join key. Right-to-erasure uses the same tombstone mechanism that handles consent revocation.

What we keep: operational telemetry about the platform itself. Worker health metrics, queue depths, error rates, and aggregated cost figures. None of this contains customer content; it describes the platform’s behavior, against which we tune deployment parameters.

What we do not keep: customer transcripts, respondent audio, fact rows, dashboard queries, methodology calibrations applied to your corpus. All of those live in your account. We access them under contract to operate the platform. We do not export them.

A DPA, a current subprocessor list, and a security questionnaire are available through contact.