On-premise by design. Audit you can prove.
Netxol One is installed on the ISP’s own servers. Subscriber data, RADIUS records and invoices stay in your data centre, and you remain the controller of your data. Netxol’s access is limited to the support sessions you grant — 30 minutes, read-only by default, shown in a banner and audited on both sides.
- 45 automated mutual-TLS checks across every service link
- Security 94% · Privacy 92% · SSO 98% in our open scorecard
- Tenancy test calls every API as a second ISP — fails on any leak
Mutual TLS between every service, down to the data store.
Each installation has its own service certificate authority. Signing keys are rotated every 90 days.
Per-installation CA
Each installation has its own service certificate authority; every link between services and to the data store uses mutual TLS.
TLS 1.2–1.3 everywhere
HTTPS, MQTT, RadSec, RADIUS/1.1, syslog, CWMP over HTTPS, LDAPS.
Encrypted at rest
Keys, device credentials and identity documents are encrypted with the installation’s master key; backups are encrypted and sealed.
Passkeys, SSO and per-call authorisation.
Role capabilities are checked on every API call; the same checks apply through the console and the public APIs.
Passkeys (WebAuthn) & TOTP
Passkeys and authenticator-app codes for staff, with recovery codes and policy; optional two-step sign-in for subscribers.
SSO: OIDC, SAML, LDAP, SCIM
Single sign-on with OpenID Connect, SAML 2.0 and LDAP / Active Directory; SCIM 2.0 provisioning.
Role-based access on every call
Role capabilities checked on every API call; sessions in HttpOnly cookies with a strict content security policy; per-user and per-address request limits.
SHA-256 chained, checked daily.
Every important action is written to an append-only audit trail in which each entry is chained to the previous one with SHA-256 and checked daily. If a record were changed, the chain would show it.
Built-in tools, not a bolted-on page.
The ISP remains the data controller. Netxol One records the processing it does on your behalf, with the deadlines regulators expect.
Data-subject requests
Access, portability export, erasure with legal holds and restriction — with deadlines.
Consent per channel
Opt-in marketing with full consent history.
Breach register
Authority deadlines built in — 24 hours for EU telecom operators, 72 hours under GDPR art. 33 and Saudi PDPL.
Record of processing
With impact assessments (GDPR art. 30 and 35).
PII masked before Netxol AI
Personal data such as phone numbers and ID numbers is masked before Netxol AI sees it.
Per-country retention, every look-up logged.
Case references on every lawful look-up; authorised staff only.
Per-country retention
Pakistan PECA s.32, Spain Ley 25/2007, Italy art. 132, Saudi Arabia — legal minimums enforced.
Lawful IP look-ups
Authorised staff can resolve a public IP address and port to a subscriber from RADIUS sessions, DHCP leases and CGNAT port blocks — with a case reference on every look-up.
Controls mapped. Certificates on their way.
Our controls are mapped to ISO/IEC 27001:2022 Annex A, the AICPA Trust Services Criteria, ISO 22301 and, for Netxol AI, ISO/IEC 42001 and the NIST AI RMF. These documents prepare for an audit; they are not a certificate. We will publish certificates here when accredited auditors issue them. The security pack (statement of applicability, control matrix, architecture) is available under NDA.
What auditors and procurement typically ask.
Is Netxol One ISO 27001 certified?
Not yet. Netxol One’s controls are mapped to ISO/IEC 27001:2022 Annex A and documented in a statement of applicability. Certification is granted by an accredited auditor, and we will publish it when issued.
Where is subscriber data stored?
On the ISP’s own servers. Netxol One is installed on-premise, so subscriber records, RADIUS sessions and invoices stay in the ISP’s data centre.
Does Netxol One help with GDPR?
Yes. It records data-subject requests with deadlines, exports and erases data with legal holds, keeps consent history, runs a breach register with authority deadlines and keeps a record of processing with impact assessments. The ISP remains the data controller.
How are services inside Netxol One secured?
Each installation has its own certificate authority. Every service and data store uses mutual TLS, so only known services can talk to each other.
Can Netxol staff access our data?
Only through a support session you approve: 30 minutes, read-only by default, shown in a banner and audited on both sides.
Does Netxol One support single sign-on?
Yes: OpenID Connect, SAML 2.0 and LDAP / Active Directory, with SCIM 2.0 for user provisioning and passkeys or authenticator codes for multi-factor sign-in.
Your data stays in your data centre. We prove it.
Request the security pack under NDA — statement of applicability, control matrix and architecture. For GDPR, Saudi PDPL and country-retention guidance, talk to a specialist.