Home/Company/Security & Trust
Built to pass procurement.
No vague trust language, no borrowed badges. Data handling, AI guardrails, access controls, certification status.
AI AGENT GUARDRAILS
Four controls on every agent.
The controls behind the outcomes on Results, detailed under AI Governance & Safety.
CONTROL 01
Approval gates
Consequential actions (sends, publishes, data changes) wait for named human approval.
CONTROL 02
Non-destructive scopes
Agents create and stage. They never bulk-delete or overwrite production state.
CONTROL 03
Credential isolation
No standing secrets. Credentials are task-scoped, injected at runtime, revocable without redeployment.
CONTROL 04
Allowlists
Each agent is pinned to authorized systems, such as the Munchkin-ID allowlist on the Marketo Campaign QA Copilot.
DATA HANDLING
Where your data lives.
Client systems first
Client data stays in client-controlled systems: AEM, Marketo, Salesforce.
Least-privilege access
Named pod members only, role-based, granted per engagement and revoked at close.
Environment separation
Development, staging, and production separated per engagement, credentials isolated.
CONFIDENTIALITY & DELIVERY CONTROLS
One standard across four markets.
Controls travel with the work across Schaumburg, Markham, Hyderabad, and Dubai. See Global Delivery.
CROSS-ENTITY IP FRAMEWORKS
Confidentiality and IP-assignment frameworks bind the US and India entities.
DELIVERY-CENTER ACCESS CONTROLS
Role-based physical and logical access, engagement-scoped credentials, and data-residency options including Canadian delivery from Markham, Ontario.
NDA-FIRST ENGAGEMENT
NextRow signs NDAs before assessments and answers security questionnaires in writing.
COMPLIANCE POSTURE
Where we are, stated honestly.
A SOC 2 readiness program is underway; NextRow claims no certification it does not hold. Today's documented practice: the guardrails above, access controls at every center, and alignment with Anthropic usage policies. The same controls run the pharma workloads on Pharma & Life Sciences and the compliance framing on Financial Services.
ANSWERS · FAQ
What security and procurement teams ask
Not yet, and NextRow will not claim otherwise: a SOC 2 readiness program is underway. In the meantime, the controls that matter (role-based access, credential isolation, confidentiality frameworks across the US and India entities) are documented and available for procurement review during the assessment stage.
Four concrete controls on every deployment: approval gates before consequential actions, non-destructive operating scopes, credential isolation so agents never hold standing secrets, and explicit allowlists, such as the Munchkin-ID allowlist restricting the Marketo Campaign QA Copilot to authorized instances. The full model is documented under AI Governance and Safety.
Only the named pod members assigned to your engagement, under role-based, least-privilege access that is revoked at engagement close. Client data stays in client-controlled systems wherever the architecture allows; NextRow's delivery centers in four markets operate under the same documented access-control standard.
Through confidentiality and IP-assignment frameworks that bind both NextRow entities, US and India, so work product and client information carry the same obligations in every delivery center. Data-residency options, such as Canadian delivery from Markham, are scoped per engagement.
AI systems ship with human accountability designed in: humans keep sign-off on consequential decisions, agents operate within documented scopes, and deployments align with Anthropic usage policies, a discipline NextRow carries as an Anthropic Claude Certified Partner. Governance documentation is a deliverable, not an afterthought.
Yes. That is the intended use of this page. Security questionnaires, access-control documentation, and the AI governance model can be reviewed during a fixed-scope assessment, before any production commitment. Most reviews complete within the assessment's 4 to 6 week window.
Send us the security questionnaire.
Controls, access model, and AI governance documentation reviewed inside a fixed-scope assessment, before any production commitment.