NexCFO AIBuilt to be audited.
Financial data deserves discipline. This page shows exactly where we stand on security, privacy and AI governance — including what is not done yet. We would rather be checkable than impressive.
Last reviewed: 7 October 2026 · NexCFO is in product preview and onboarding its first customers.
- In implementationBeing built into the product now.
- RoadmapPlanned. Not yet built.
Product controls
| Control | What it means | Status |
|---|---|---|
| Human approval on every external action | Payments, messages to customers and suppliers, filings and journal entries wait for a named person. | In implementation |
| Audit trail | Who, what, when and why for every agent and human action, exportable for your auditor. | In implementation |
| Explained reasoning | Each output records the steps, data and rules it used. | In implementation |
| Role-based access | Roles, approval rights and least-privilege defaults per person and per agent. | In implementation |
| Read-only integrations | Connections start read-only; write access is requested separately. | In implementation |
Infrastructure & data
| Control | What it means | Status |
|---|---|---|
| Encryption in transit and at rest | TLS for all traffic; encrypted storage. Technical details will be published here. | In implementation |
| Hosting & data residency | Hosting provider and region will be listed here before the first customer goes live. | In implementation |
| GCC data hosting | Option to keep data in a GCC cloud region. | Roadmap |
| Backup & recovery | Backup frequency and recovery targets will be published here. | In implementation |
| Data retention & deletion | Customer data deleted on exit within a published period. | In implementation |
| Private / dedicated deployment | Dedicated environment for larger groups. | Roadmap |
Assurance
| Control | What it means | Status |
|---|---|---|
| Independent penetration test | Before general availability; summary letter on request. | Roadmap |
| SOC 2 (Type I, then Type II) | Planned once we have customers in production. | Roadmap |
| ISO/IEC 27001 | Planned. | Roadmap |
How our agents are allowed to work.
- Agents prepare; people decide. Every external action needs a named approver.
- Every output records its reasoning and the data it used.
- You set each agent's autonomy, from observe-only to draft-for-approval.
- Your data is used to serve your business. We will publish the AI model providers we use and their data terms here, and we will not use one that trains its models on your data.
- Agents can be paused or switched off at any time.
The laws we design for.
We design NexCFO to meet the data-protection laws of the markets we serve, including Qatar's Personal Data Privacy Protection Law (Law No. 13 of 2016), the UAE and Saudi personal data protection laws, India's Digital Personal Data Protection Act 2023 and, where EU personal data is involved, the GDPR.
See our Privacy Policy for how this website handles personal data.
Security questions?
Write to security@nexcfoai.com. We will share a one-page security overview with procurement teams on request.
See NexCFO on your own numbers.
A 30-minute walkthrough with the founder. Read-only access, no commitment.