Get Nexus free →
SECURITY

Your data never
leaves your machine.

Nexus Prime is local-first by architecture, not by policy. There is no server to breach, no cloud database to leak, and no API key to rotate. Your memory lives on your hardware.

🔒

Local SQLite. No cloud.

Agent memory is stored in ~/.nexus-prime/memory.db — a plain SQLite file on your machine. Nexus Prime never contacts any external database. Your architectural decisions, code patterns, and project context stay yours.

✓ Zero outbound data for core features ✓ Inspect the DB with any SQLite client ✓ Back up with cp
🔑

Ed25519 license signing

Every license key is a signed Ed25519 JWT. Verification is fully offline — the CLI validates the signature against the embedded public key. No license server, no phone-home, no internet required at runtime.

✓ Offline-first key verification ✓ No license server dependency ✓ Tamper-evident signatures
🛡️

Zero telemetry by default

Nexus Prime collects zero telemetry without explicit opt-in. No usage analytics, no error reporting, no session data leaves your machine unless you choose to enable it. Enterprise customers can fully disable all outbound network activity.

✓ Default: no telemetry ✓ Opt-in only for analytics ✓ Enterprise: full air-gap mode
🔐

No shared secrets

Nexus Prime never asks for your Claude API key, Cursor token, or any AI provider credentials. It sits between your editor and the agent process — no credentials pass through Nexus. Your keys stay in your environment.

✓ Zero credential intermediation ✓ MCP transport only — no key storage ✓ Agent credentials stay in your shell
📁

Scoped file access

The Nexus MCP server only accesses files within your active project directory. It respects .gitignore, .nexusignore, and any path exclusions you configure. It never reads outside your project root.

✓ Project-scoped reads only ✓ .nexusignore support ✓ No home directory access
📋

Full audit trail

Every Nexus action is written to a local audit log: memory reads, memory writes, worktree creates, session handoffs. The log is append-only, human-readable JSON, and never leaves your machine.

✓ Append-only local JSON log ✓ Timestamped + agent-attributed ✓ Export via nexus-prime audit export
COMPLIANCE ROADMAP

SOC 2 Type II in progress.

Nexus Prime's local-first architecture means most SOC 2 controls are already satisfied by design — there is no cloud infrastructure to audit. We are currently scoping a Type II report for enterprise customers who require formal certification.

Expected audit window: Q3 2026. If your procurement team needs a formal timeline or a security questionnaire, contact us and we'll provide documentation directly.

View SLA → security@nexus-prime.cfd
Current posture
✓ Data encryption at rest (AES-256 SQLite)
✓ No cloud data storage for core features
✓ Ed25519 license key signing
✓ Zero telemetry by default
✓ Local-only audit log
✓ Project-scoped file access
✓ Dependency vulnerability scanning (CI)
○ SOC 2 Type II report
○ Pen test (external, annual)
○ DAST in CI pipeline

Responsible disclosure

Found a security issue? Email security@nexus-prime.cfd with a detailed description. We respond within 48 hours, triage within 7 days, and credit researchers in release notes unless they prefer anonymity.

We do not pursue legal action against good-faith security researchers. We ask that you give us 90 days before public disclosure.

PGP key fingerprint Coming soon — email us directly for now