The governance layer auditors can stand behind.
nxtlinq's controls are examined by an independent auditor and summarised in a public SOC 3 report. Every AI agent action generates cryptographic, blockchain-anchored evidence: compliance as architecture, not a checkbox.
nxtlinq is a member of NVIDIA Inception.nxtlinq System and Organization Controls (SOC) reports are independent third-party examinations that show how nxtlinq achieves its key compliance controls and objectives.
Two reports are available: a SOC 2 report for customers that need detailed control evidence, and a SOC 3 report that anyone can read.
A summary of the auditor's opinion and nxtlinq's system description. Download it below; no NDA required.
The detailed report, with control descriptions and test results, for customers and prospects with a business need.
HIPAA, SOX, FedRAMP and air-gapped sovereign deployment. See how below.
Beyond the annual reports, every agent action leaves its own cryptographic record on the ledger.
Both reports come from the same independent examination. They differ in how much they show and who can read them.
| Question | SOC 2 | SOC 3 (public) |
|---|---|---|
| Report typeWhat is the report? | A detailed description of internal controls, with the auditor's tests and results | A public-facing attestation, without internal system detail |
| Audit standardUnder what standard is the examination performed? | SSAE No. 18 (AT-C §105, §205) · AICPA SOC 2 Guide · TSP §100A 2017 Trust Services Criteria | SSAE No. 18 (AT-C §105, §205) · TSP §100A 2017 Trust Services Criteria |
| CriteriaWhich Trust Services Criteria are in scope? | Listed in the report, available on request | Security |
| PurposeWhat is the report for? | Gives customers an independent assessment of nxtlinq's control environment | Gives anyone an independent assessment of nxtlinq's control environment without disclosing internal system information |
| AudienceWho is it for? | nxtlinq customers and prospects with a business need | Everyone; no NDA required |
| AccessHow do I get it? | Ask your nxtlinq account team or use the contact form | Download the PDF (opens in a new tab) |
Every human principal holds a Human Identity Token (HIT). Every AI agent is issued an Agent Identity Token (AIT): scoped, time-bound and cryptographically chained to its HIT. No action can occur without a verifiable identity at both ends of the delegation chain.
The ASTP framework (Attributable · Scoped · Time-bound · Provable) enforces governance before any agent acts, not after. Each action is checked against the AIT's policy envelope; out-of-scope requests are blocked and logged.
Every governance event (authorization, scope enforcement, policy evaluation, execution outcome) is hashed and committed to an immutable ledger. No operational data is stored on-chain, only cryptographic commitments.
Multi-agent workflows keep an unbroken delegation chain. Sub-agents, tool invocations and cross-model handoffs inherit and extend the parent AIT context, so every action traces back to a named, verified person.
Any authorized action can be reconstructed for incident investigation or regulatory review, with the full policy state, delegation context and execution path, without relying on fragile logs.
nxtGPT and nxtNLP produce Trusted Data Packets (TDPs): versioned data objects carrying provenance, authorization context and cryptographic lineage, the auditable unit of AI-generated output.
SOC, HIPAA, SOX and FedRAMP auditors ask the same four questions about AI deployments. Here is how nxtlinq answers each one.
Every agent action traces to a named person through an unbroken HIT → AIT delegation chain. Scope, time limits and permissions are recorded cryptographically when the token is issued.
Every action (reads, writes, API calls, tool invocations) is logged to the audit ledger at execution, with the agent's AIT, a hash of the payload and the policy result.
Any change to an audit record breaks the hash chain, so alterations are detectable without trusting nxtlinq's own infrastructure.
Deterministic replay rebuilds any authorized event with its policy state, delegation context and decision path at the time of execution.
For defense, intelligence and the most regulated sectors, where data sovereignty is non-negotiable, nxtlinq supports complete air-gapped deployment: no cloud dependency, no external API calls, no data leaving your perimeter.
Okta, Entra ID and Ping were built for human credentials. They authenticate who logs in, but see nothing of what an agent does after that. nxtlinq makes the delegation chain from person to agent visible, inside your own walls.
nxtID, nxtNLP and nxtGPT deploy entirely within your infrastructure, together with the HIT/AIT fabric, the audit ledger and the policy engine.
Governance wraps any model: self-hosted Llama or Mistral, private fine-tunes or classified inference environments.
The audit ledger runs on a private chain with no public-chain dependency and no external validators.
SOC evidence, HIPAA access records and SOX-ready trails are generated and kept internally. No cloud provider sits in the chain of custody.
The air-gapped deployment, layer by layer. Nothing on this stack calls out.
No external network calls · no cloud dependency · all data stays inside your perimeter.
Issuance, scoping and lifecycle of cryptographic agent identities: AIT creation, task-specific permission binding, micro-runtime TTL enforcement and sub-agent delegation chain integrity.
Runtime data encapsulation for policy-enforced access control without modifying systems: how data is wrapped, scoped and protected at the execution layer.
Cryptographic anchoring of identity events, execution outcomes and governance decisions: hash commitments, zero PII on-chain and deterministic forensic replay.
Tokenized feedback through Trusted Data Packets, human oversight and audited reinforcement loops, with ledger-anchored proof of human review.
Semantic clustering, intent classification and context-aware generative AI control: prompt analysis, behavioral inference, context memory lifecycle and ML-based adaptive interaction.
Data sovereignty and access control for AI agents working with PHI.
Financial reporting controls and audit trails for agents in finance workflows.
Federal security for AI in government and defense environments.
Data residency, right to audit and accountable AI decisions for European deployments.
Download the public SOC 3 report now, or request a 15-day POC to see nxtlinq's evidence architecture in your own environment.
© 2026 NVIDIA, the NVIDIA logo, and NVIDIA Inception are trademarks and/or registered trademarks of NVIDIA Corporation in the U.S. and other countries.