Your members' data, in Australia, under your control
Member data is the most sensitive thing your organisation holds. Nexy keeps it hosted in Australia on Microsoft Azure, governed by roles, protected by MFA and encryption, with every change on an audit log. Where it lives, who touches it and what happens to it are questions with plain answers here.
Where is our member data stored?
Nexy stores member data in Australia, on Microsoft Azure, on every tier. Access is governed by role-based controls with multi-factor authentication, every change is written to an audit log, and member data is never used to train AI models. Hosting, access and data handling are answered in writing before you commit.
Five questions every board should ask. Our answers, on the record.
Sovereignty is not a slogan; it is a short list of questions with verifiable answers. Ask them of every vendor on your shortlist, including us.
Sovereignty is a supply-chain question.
Every vendor in an assembled suite is another place your member data lives: another hosting decision made by someone else, another privacy policy to police, another set of sub-processors you have never met. The question is not whether each tool is reputable. It is how many copies of your membership exist, and under whose rules.
One platform collapses that chain. One copy of the data, one set of access controls, one audit trail, hosted in Australia. When the sovereignty question arrives in a board pack or a procurement template, the answer fits on one line.
- ✓Commitment: Any AI capability we ship will run on sovereign Australian infrastructure
- ✓Commitment: Member data will never train our models or anyone else's
- ✓Commitment: AI will inherit the platform's roles, permissions and audit logging
- ✓Commitment: Your organisation decides whether it is on at all
Published before the features, so the rules never bend to the roadmap.
Plain answers, on every tier.
Hosted in Australia
Member data lives on Microsoft Azure in Australia, on every tier, not as an enterprise add-on.
Governed access
Role-based access controls and MFA on every admin surface. People see what their role allows, nothing more.
Every change on the record
Audit logging records who changed what and when, at a granularity built for regulatory enquiry at Enterprise.
One copy, one platform
CRM, website, events, payments and community on one product means one copy of your data under one set of rules.
Communications governed
Messages go out through the platform, on the record, with delivery visible, not through exported lists in third-party tools.
Questionnaires welcome
Hosting, access, audit and data handling answered in writing before you commit. Sovereignty claims should survive procurement.
We do not publish who our clients are.
A vendor's client list is useful to more people than buyers. Published together, it tells anyone who cares exactly which organisations hold their member data in one place, and which single supplier is worth attacking to reach all of them. Sector-wide, that is how a supply-chain attack gets its shortlist.
So we do not run a logo wall. Not now, and not when the list is long. Showing off our clients would help our marketing and add a small amount of risk to organisations that trusted us with the most sensitive data they hold. That is not a trade we are willing to make on their behalf.
If you want to know who uses Nexy, ask. We will talk you through real examples, and where a client is happy to speak with you directly, we will introduce you. Reference conversations belong in a procurement process, not on a public page.
- →A conversation about organisations like yours, what they run and what changed.
- →An introduction to a client willing to speak with you directly.
- →Your sovereignty and security questionnaire answered in writing, before you commit.
- →A demo on your own structure, not a scripted tour.
Your software vendor is part of your attack surface.
Most of the incidents that reach a membership organisation now arrive through a supplier rather than through its own front door. That is not an argument for fewer suppliers in the abstract. It is an argument for knowing exactly how many of them hold a copy of your member data, and being able to answer, in writing, what each one does with it.
One platform means one answer to that question instead of five. Here is ours, before you ask for it.
Where it lives
In Australia, on Microsoft Azure, on every tier. Not a paid data-residency option, and not an offshore region with an Australian sales page.
Who can reach it
The people your organisation authorises, under role-based access with multi-factor authentication. Our own access is limited, purposeful and logged.
What is recorded
Changes are written to an audit log, so the question of who did what and when has an answer rather than a theory.
If something happens
You are told promptly and in plain language: what we know, what is affected, what we are doing and what you need to do. Notification obligations and timeframes are set out in your agreement.
What AI does with it
Never used to train a model. Inference is moving to sovereign Australian infrastructure, against requirements we publish before naming a provider.
If you leave
Your data is yours. Export and deletion on the terms written into your agreement, agreed before you sign rather than negotiated when you go.
Asked before the first call.
Where is our member data hosted?
Who can access our data?
Is our member data used to train AI models?
Why does one platform matter for sovereignty?
What happens if you have a security incident?
What happens to our data if we leave?
Why do you not show client logos?
Will you answer our sovereignty questionnaire?
Bring your sovereignty questionnaire.
Ask the five questions of every vendor on the shortlist. We will answer in writing, and show you the platform behind the answers. The argument behind the product is in Issue 7 of The Platform Realist.