Our policies: how we do business.

One place for how Nexus operates

These policies apply to Nexus Security Advisors and to anyone who works on our behalf, including employees, contractors, and subcontractors. Where a client contract sets a stricter requirement, the contract governs.

Last updated November 3, 2026

Integrity is the product

A security advisor is only as useful as their word. This code describes the standards we hold ourselves to in every engagement.

Honesty in what we say and sell

• We describe our services, credentials, and experience accurately, and we don't overstate results or guarantee outcomes no one can guarantee.
• We tell clients what they need to hear, including findings that are uncomfortable or that reduce the work we would otherwise be paid for.
• We don't make claims about compliance, certification, or “AI-powered” capabilities that we can't support.

Confidentiality

• Client information, findings, and vulnerabilities are confidential. We share them only with the client, or as the client directs or the law requires.
• We never use one client's confidential information to benefit another, or for our own advantage.

Fair dealing and respect

• We compete on merit and don't disparage competitors unfairly or misuse their confidential information.
• We treat everyone with respect and don't tolerate harassment or discrimination based on any characteristic protected by law.
• We follow the laws and regulations that apply to our work, including export-control, privacy, and government-contracting rules.

Authorized work only

We test, scan, or access systems only with written authorization and within the agreed scope, and we stop and notify the client if we encounter something outside it.

Accurate records

We keep accurate books, timesheets, invoices, and engagement records, and we never falsify or backdate documents. For government work, this code is intended to support the contractor business-ethics expectations in the Federal Acquisition Regulation (FAR), including timely disclosure of credible evidence of certain violations.

Advice you can rely on

Our recommendations should reflect what is best for the client, not what pays us best.

Disclosure

• We disclose in writing, before you decide, any financial interest we have in a product or service we recommend, including tools or software that Nexus builds or sells, reseller or partner arrangements, and referral fees.
• We don't accept undisclosed commissions, referral fees, or incentives from vendors for steering clients to them.
• Clients are always free to choose any qualified vendor, including one we have no relationship with.

Independence in assessments

• We don't present as independent an assessment or audit of controls that we designed or operate for the same client. If a client asks us to review our own work, we label it clearly as an internal review.
• Where a framework, regulator, or contract requires third-party independence, we say so and help the client find an independent assessor.

Competing interests

Before taking on an engagement, we check for conflicts with existing clients or commitments. If a conflict arises, we disclose it promptly and, if it can't be managed with the informed consent of everyone affected, we step back.

Zero tolerance

We comply with the U.S. Foreign Corrupt Practices Act (FCPA), U.S. federal and state anti-kickback and gratuity rules, and the anti-bribery laws of every country where we work, including the UK Bribery Act where it applies.

• We never offer, promise, give, request, or accept a bribe, kickback, or anything of value to improperly win or keep business or gain an advantage.
• We don't make “facilitation” or “grease” payments, even where local practice tolerates them.
• Gifts and hospitality must be modest, infrequent, lawful, transparent, and never tied to a pending decision. We don't give gifts to government employees except as their own ethics rules expressly allow.
• We don't make political contributions on behalf of Nexus to obtain business.
• We expect the same standards from subcontractors and partners who act for us, and we record payments accurately so nothing can be hidden.

We protect your data like we tell you to

• Collect the minimum. We ask only for the information an engagement requires, and we prefer to review sensitive systems in place rather than take copies.
• Need-to-know access. Client data is available only to the people working on that engagement, using accounts protected by multi-factor authentication.
• Encryption. Client data is encrypted in transit and at rest in business-grade systems.
• No AI training on your data. If we use AI tools in an engagement, we use only business services that don't train their models on customer data, and we don't put client-confidential information into consumer AI tools. See Responsible AI.
• Return or delete. When an engagement ends, we return or securely delete client data within 90 days unless the contract specifies otherwise or the law requires us to keep it. We keep deliverables and business records only as long as needed for legal and accounting purposes.
• Incident notice. If we learn of a security incident affecting client data, we notify the affected client without undue delay so they can meet their own obligations.

For how this website handles visitor information, see our privacy notice.

Tell us if something looks wrong

If you believe anyone acting for Nexus has broken one of these policies, email [email protected] with the subject “Ethics concern.” We will review every report promptly and confidentially to the extent the law allows, and we will not retaliate against anyone who raises a concern in good faith.

These policies are reviewed at least once a year and whenever our services or obligations change.