Security and trust

How we work

Every NexOps engagement follows the same written delivery standards. If a client standard is stricter, we use the client standard.

• Secure by design: the secure configuration is the default and access is denied unless someone needs it.
• Privacy by design: we collect and store only the data the use case needs, keep personal data in the agreed region and define a retention period for each dataset.
• Least privilege: access goes to groups with the smallest set of permissions that does the job, and unused access is removed.

Identity and access

All access runs through Microsoft Entra ID security groups, synced to Databricks at account level. We do not add users directly to workspaces, catalogs, schemas or Azure resources.

Privileged roles are eligible, not active. They are activated through Privileged Identity Management for a limited time, with a reason and multi-factor authentication, and with approval in acceptance and production. Pipelines use service principals or managed identities, and CI/CD uses workload identity federation instead of stored secrets.

Data protection in the platform

In Unity Catalog every schema has a reader group and a contributor group, and a group owns every catalog, schema, table and volume. All groups and grants are defined in code. We classify data before we load it and protect sensitive columns with masks, row filters or pseudonymisation.

We do not use production personal data in development or test, and we do not send client data to external AI services unless the client agrees in writing.

Network and secrets

Platform services use private endpoints, public network access is disabled where the service supports it, and Databricks is deployed with VNet injection and secure cluster connectivity. Secrets, keys and certificates live in Azure Key Vault with role-based access, soft delete and purge protection. Secret scanning runs on every pull request.

Change control and infrastructure as code

We work in four environments: development, test, acceptance and production, each with its own resources and identities. Changes reach production through pull requests with build validation and code scanning. Infrastructure is defined in Terraform, using our own modules where they exist, and Databricks Asset Bundles are deployed only by pipelines. We do not change resources by hand in the portal.

Where we run your workloads

You decide where your data lives. We run platforms on Azure in the region you choose, and sovereign AI on Nebius in European regions, on your own servers or on Azure in an EU region. For EU clients we use EU regions only.

Sovereign and self-hosted AI

Service levels

Each managed service runs under a written service level agreement (SLA) agreed with the client. The SLA sets response and resolution times per priority from P1 to P4, the service hours, the escalation route and the reporting. We agree the times with you for your platform and put them in the contract.

Talk to us about an SLA

Sub-processors of this website

These providers process personal data for nexops.nl. Sub-processors for a client engagement are listed in the data processing agreement of that engagement. The current list of sub-processors is available on request.

Data processing agreement

Data processing agreement: available on request for every engagement.

Request a data processing agreement

Responsible disclosure

If you find a security problem on nexops.nl, write to info@nexops.nl with the subject "Security". Describe what you found and how to reproduce it. We confirm receipt within two working days and keep you informed until it is fixed.

Please do not access data that is not yours, do not disrupt the site and give us reasonable time to fix the problem before you share it. The security.txt file lists the same contact.

security.txt