Third-party risk management

Security and AI diligence brief

ThirdNexa at a glance, for your vendor file.

A short summary for security, compliance and vendor-management reviewers. The full question-by-question package and our standard data processing addendum are linked below.

Last updated: November 3, 2026

Draft — pending legal review. This document, and the Data Processing Addendum linked from it, are not yet approved for publication and may change before final release.

Full due diligence package

1. Company and service

  • Contracting entity: ThirdNexa LLC, a United States limited liability company and sole operator of the service.
  • Service: multi-tenant vendor oversight software for SEC- and FINRA-regulated firms — inventory, due diligence, reviews, findings, contracts, decision records and exam evidence packs.
  • Maturity: early-stage service in a limited beta with a small number of firms.
  • Contacts: security and diligence support@thirdnexa.com; commercial sales@thirdnexa.com.

2. Architecture and data flow

  • Browser → encrypted connection (TLS) → managed edge runtime in the United States.
  • Application data in a managed PostgreSQL database in a single United States region, encrypted at rest, including backups and uploaded files.
  • Firm separation enforced by database row-level security on every read and write, not by page visibility alone.
  • AI requests go through a zero-data-retention gateway; results return as drafts for a person to review.
  • Decisions, finding closures and approvals are written to an append-only log with actor, time and rationale.

3. Security controls in place today

  • Mandatory authenticator-app multi-factor authentication; no shared logins.
  • Roles: Firm Admin, Compliance Officer, Reviewer, Auditor/Read-Only, enforced on the server.
  • Separation of duties: a finding cannot be verified by the person assigned to fix it; risk acceptance is limited to firm administrators.
  • ThirdNexa staff access is least-privilege, limited to support and operations, and recorded.
  • Automated regression tests cover role permissions and cross-firm data isolation.

4. AI data governance

  • Customer content is not used to train or fine-tune any model serving ThirdNexa.
  • AI requests use zero-data-retention endpoints with provider-side storage disabled.
  • ThirdNexa keeps its own record of AI activity for auditability and support; provider zero retention is not the same as no record.
  • AI never labels a vendor approved or compliant and never issues regulatory or legal conclusions. The firm records every decision.
  • AI features in the product (document reading, questionnaire pre-review, contract clause suggestions) are announced in release notes before firms use them.

5. Subprocessors

  • Lovable — application hosting and delivery (United States).
  • Lovable Cloud — database, authentication and file storage (United States).
  • Lovable AI Gateway (OpenAI models) — AI document reading and drafting through zero-retention endpoints (United States).
  • Lovable email infrastructure — system and reminder email (United States).
  • Stripe — subscription billing; ThirdNexa never receives card numbers (United States).

6. Assurance status — stated plainly

  • No SOC 2 report today. SOC 2 Type I in preparation, target Q3 2027; Type II follows.
  • Independent penetration test planned, target Q2 2027.
  • No SAML single sign-on or customer-selectable data residency today.
  • Insurance: general liability, errors and omissions, and a cyber endorsement are in force; a certificate is available on request.
  • We complete your own questionnaire (SIG, CAIQ or custom) at no charge, separating controls in place from planned work.

7. Continuity and exit

  • Automated encrypted backups with point-in-time recovery. Internal targets: service restored within four hours, data loss no more than one hour (operating targets, not audited or contractual).
  • Self-service Full Data Export at any time: all records (CSV and JSON), settings and original files, no fee.
  • Departure window of 30–365 days (default 90) before staff-approved permanent removal; lapsed subscriptions become view-and-export only.

ThirdNexa is a software platform provided by ThirdNexa LLC. ThirdNexa does not provide legal, regulatory, or compliance advice, and use of the platform does not guarantee compliance with any law or regulation or any particular examination outcome. Each firm remains solely responsible for establishing and maintaining policies, procedures, supervision, controls, and oversight appropriate to its regulatory obligations. ThirdNexa LLC is not affiliated with or endorsed by the SEC, FINRA, or any other regulatory authority.