Built from the ground up for regulated industries. HIPAA, PCI-DSS, GDPR, and SOC 2 compliance features are native to the platform, not afterthoughts.
Health Insurance Portability and Accountability Act
US federal law protecting sensitive patient health information from disclosure without consent.
Payment Card Industry Data Security Standard
Security standard for organizations handling branded credit cards from major card schemes.
General Data Protection Regulation
EU regulation on data protection and privacy for individuals within the European Union.
Service Organization Control 2
Auditing procedure ensuring service providers securely manage data to protect privacy.
Nexion detects and protects all 18 HIPAA Safe Harbor identifiers at runtime, before data is persisted. Choose from 6 protection methods based on your use case.
***-***-1234a8f5f167...[REDACTED]gAAAABl7...tok_xxxxx(removed)Complete mapping of HIPAA-required identifiers to Nexion protection methods
| # | Identifier | MASK | HASH | REDACT | ENCRYPT | TOKENIZE | SKIP |
|---|---|---|---|---|---|---|---|
| 1 | Names | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| 2 | Geographic data (< state) | ✓ | — | ✓ | — | — | ✓ |
| 3 | Dates (except year) | ✓ | — | ✓ | — | — | ✓ |
| 4 | Phone numbers | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| 5 | Fax numbers | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| 6 | Email addresses | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| 7 | Social Security numbers | — | ✓ | ✓ | ✓ | ✓ | ✓ |
| 8 | Medical record numbers | — | ✓ | ✓ | ✓ | ✓ | ✓ |
| 9 | Health plan IDs | — | ✓ | ✓ | ✓ | ✓ | ✓ |
| 10 | Account numbers | — | ✓ | ✓ | ✓ | ✓ | ✓ |
| 11 | Certificate/license numbers | — | ✓ | ✓ | ✓ | ✓ | ✓ |
| 12 | Vehicle identifiers | — | ✓ | ✓ | — | ✓ | ✓ |
| 13 | Device identifiers | — | ✓ | ✓ | — | ✓ | ✓ |
| 14 | URLs | — | ✓ | ✓ | — | — | ✓ |
| 15 | IP addresses | — | ✓ | ✓ | — | — | ✓ |
| 16 | Biometric identifiers | — | — | ✓ | — | — | ✓ |
| 17 | Full-face photographs | — | — | ✓ | — | — | ✓ |
| 18 | Other unique identifiers | — | ✓ | ✓ | — | ✓ | ✓ |
✓ = Recommended for this identifier type |— = Not recommended (may expose partial data or not applicable)
Analytically useful, no re-identification possible
Fully de-identified for external sharing
Accessible with authorization, full audit trail
Nexion implements strict Role-Based Access Control at the resource level, a key requirement for BAA/HIPAA compliance. Every API endpoint enforces granular permissions based on resource type, action, and user role.All permission checks are enforced at API level.
| Role | Data Pods | Pipelines | Governance | Users |
|---|---|---|---|---|
| ADMIN | Full Access | Full Access | Full Access | Full Access |
| ENGINEER | Read, Write, Execute | Read, Write, Execute | Read, Write | Read Only |
| ANALYST | Read, Execute | Read, Execute | Read Only | No Access |
| VIEWER | Read Only | Read Only | Read Only | No Access |
Custom Roles: Beyond the default role hierarchy, administrators can create custom roles with fine-grained permissions for specific resources. This enables scenarios like "Pipeline Viewer" who can only read specific pipelines, or "Data Steward" with governance-only write access.
Enterprise-grade security controls built into every layer of the platform.
Encryption at Rest
AES-256 encryption for all stored data
Encryption in Transit
TLS 1.3 for all data transfers
Key Management
Integration with Azure Key Vault, AWS KMS
Data Masking
6 configurable protection methods
Strict Resource-Level RBAC
Granular permissions per resource type and action (READ, WRITE, DELETE, EXECUTE, ADMIN)
Role Hierarchy
4-tier role system: ADMIN > ENGINEER > ANALYST > VIEWER
Custom Roles
Define custom roles with specific permissions per resource
SSO Integration
SAML 2.0, OAuth 2.0, OpenID Connect
MFA Support
Multi-factor authentication required
API Key Management
Scoped API keys with rotation
Comprehensive Audit Logs
All actions logged with user, timestamp, and details
Real-time Monitoring
Pipeline execution monitoring and alerts
Anomaly Detection
Unusual access pattern detection
Compliance Reports
Exportable audit reports
Cloud-Native
Deployed on your Azure, AWS, or GCP account
Network Isolation
VNet/VPC integration, private endpoints
Disaster Recovery
Automated backups, cross-region replication
High Availability
99.9% SLA with redundant architecture
Every Azure resource is configured with compliance-grade security settings. Private Endpoints, HSM-backed keys, and 365-day audit retention are standard.
Nexion runs as a managed platform on your cloud infrastructure. Your data never leaves your cloud account, maintaining full control and compliance.
Monthly or annual billing
Azure, AWS, or GCP - pay as you use
Talk to our compliance team about your requirements.