Where the files live and who can reach them.

What is in place today, and what is not yet. We read this from Microsoft's Azure control panel on 2026-10-14 with read-only access and keep the record.

In place

In placeWhere: Customer files are stored in Azure's West Europe region, which is in the Netherlands. Where reviewers work from, and where any automated processing runs, is agreed per engagement and written down.
In placeThe lock: Files are encrypted with a key that Nikxius holds in its own Azure key vault, separate from Microsoft's default keys. The vault cannot be emptied by accident and access to it is role-based. Your firm does not hold this key; if you need to, that is an engagement question.
In placeNo public door: Neither the file store nor the key vault can be reached from the public internet.
In placeWritten security policies: Access, logging, incidents, retention, keys, suppliers and people: policy set version 1.0, dated 2026-10-15, shared with a firm on request. Not independently audited.

Per engagement

Per engagementWho can enter: Named people on an engagement, for the length of the engagement, removed at the end. This is how access is granted; no engagement has run yet, so it is a commitment, not a readback.
Per engagementData-processing agreement template: Drafted 2026-10-15 on Article 28 GDPR with the EU standard contractual clauses attached, pending review by counsel. Signed per engagement.

Not yet in place

Not yetPrivate network links: A private network in the Netherlands with private links to the file store and the key vault is scripted and reviewed as of 2026-10-15. Stated here as in place once the founder has applied it and read it back from the control plane.
Not yetAccess logging and alerts: Every read, write and delete on the file store and every use of the key vault to a log kept 90 days, with alerts to the founder on refused access, any deletion, any key change and any change to the perimeter. Scripted and reviewed 2026-10-15; stated here as in place once applied and read back.
Not yetIndependent penetration test: Scope written and testing firms listed on 2026-10-15; booked once the first engagement is signed. The website's security headers were checked and recorded on that date. That check is not a penetration test.
Not yetSOC 2 or ISO 27001: Not held. A gap assessment against ISO 27001:2022 was written on 2026-10-15. Certification needs twelve months of operating records first; it will be stated here if and when obtained.

Read on 2026-10-14 from the Azure control plane with read-only access.

Evidence supports a decision. It does not make one. The firm's MLRO keeps the final say on every file. Nikxius is not a law firm, an auditor or a regulator. No folder promises a regulatory outcome. The service is looking for its first firms.

Ask about the gaps before you ask about the controls.

The not-yet list above is the honest state. We would rather you read it here than find it later.

Talk for 30 minutes

Nikxius is run by Nikhil Sood, who replies to every request personally.