Nexly Agents talks to your customers on your behalf, so it is built not to be manipulated, not to make things up and not to send data where it should not go. Personal data is processed under a GDPR data processing agreement (DPA), and a self-hosted deployment is available.
GDPR and personal data
- Processing under a GDPR data processing agreement (DPA) that names where data is processed and which subprocessors are involved.
- Conversation analytics see placeholders such as [email], [phone] and [address] instead of personal data.
- Technical logs are cleaned of e-mail addresses and card numbers and deleted after 90 days.
- We use a model API in which the data sent is not used for training.
- Each company’s data is separated from other customers.
- Hosting on Nexly Lab infrastructure or self-hosted on your own servers.
- Nexly Lab sp. z o.o. is a company registered in Poland (EU): KRS 0001190628, NIP 5253058699. Details in the privacy policy.
The path of every message
| Step | What happens |
|---|---|
| Customer message | On the website or in a messenger |
| Content filter | Filters out harmful content |
| Guard | Checks the topic and manipulation attempts |
| Agent with your knowledge | Content from the knowledge base is treated as data, not instructions |
| Link control | Only your domains are clickable |
| Answer with a source | Or an honest “I don’t know” and handoff to a person |
Protection against manipulation and hallucinations
- Hard to manipulate. A separate guard checks every message before it reaches the agent. Attempts like “ignore your instructions” end with a polite refusal.
- Only your links. A link in an answer is clickable only when it leads to domains you allow; a planted phishing address stays plain text.
- Says only what it knows. The agent answers from your materials and shows the source. When something is not in the knowledge, it says so and offers contact with a person instead of guessing.
- Boundaries and limits. The agent does not ask for passwords or card numbers, does not promise refunds and does not give medical or legal advice. Message and cost limits with a hard stop, plus abuse detection, protect against spam.
- Human in the loop. Difficult cases go to a person with the whole conversation. Panel access depends on roles, and changes to the agent and the knowledge are logged.
Technical safeguards
- The widget answers only on domains you specify.
- Integration keys are encrypted with AES-256.
- Every answer has a full trace: source, cost and time.
- Quality is measured on a set of control questions before every change of the agent.
Frequently asked questions
Is Nexly Agents GDPR-compliant?
Personal data is processed under a GDPR data processing agreement (DPA) that names where data is processed and which subprocessors are involved. Personal data is masked in conversation analytics, technical logs are deleted after 90 days, and a self-hosted deployment is available.
Is our company data used to train AI models?
No. We use a model API in which the data sent is not used for training. Your knowledge serves only your agent.
Can Nexly Agents run on our own servers?
Yes, a self-hosted deployment is available.
What happens when someone tries to trick the agent?
A separate guard checks messages before they reach the agent, and manipulation attempts end with a polite refusal. Content from the knowledge base is treated as data, not as instructions, and only links to your domains are clickable.