Security & Compliance

This document describes the security posture of AllCode Nexus for review by your security and compliance teams.

Architecture Security Model

AllCode Nexus follows a shared responsibility model:

Data Handling

What AllCode Nexus Stores

• Organization metadata (name, subscription ID, configuration)
• User email addresses (from OIDC tokens, for usage attribution)
• Aggregated usage metrics (token counts, request counts, timestamps)
• Quota policy configurations

What AllCode Nexus Does NOT Store

• User prompts or conversations
• Code, files, or intellectual property
• AWS credentials or secrets
• OIDC tokens (used transiently, never persisted)
• Personally identifiable information beyond email addresses

Data Flow

1. Users authenticate directly with your IdP — credentials never pass through AllCode
2. OIDC tokens are exchanged for temporary AWS credentials via Cognito in your account
3. Claude Code communicates directly with Amazon Bedrock in your AWS account
4. Usage metrics (token counts only) are reported to the Nexus analytics pipeline

No customer code or conversation data ever leaves your AWS account or passes through AllCode infrastructure.

Encryption

IAM Security

The CloudFormation stack creates the minimum required permissions:

• Bedrock Access Role — Can only invoke Anthropic models via Bedrock. Cannot create, delete, or modify any AWS resources.
• Trust Policy — Restricted to your specific OIDC provider and Client ID. No cross-account access.
• No Admin Permissions — The role has no IAM, EC2, S3, or other service permissions.
• Regional Scoping — Bedrock access can be restricted to specific regions.

Credential Lifecycle

• Temporary credentials expire after 1 hour
• No long-lived API keys or secrets are created
• Credentials are never written to disk
• Token refresh happens automatically via OIDC re-authentication

Compliance Readiness

Audit Capabilities

• Audit Log in the Nexus portal records all administrative actions
• AWS CloudTrail captures all Bedrock API calls in your account
• User attribution — Every Bedrock request is traceable to a specific user via IAM session tags
• Immutable logs — Audit records cannot be modified or deleted by customers or AllCode staff

Network Security

• All Nexus portal and API traffic uses HTTPS (TLS 1.2+)
• The credential helper communicates only with:
  • Your OIDC provider (authentication)
  • AWS STS (credential exchange)
  • Amazon Bedrock (model invocation)
  • Nexus metrics endpoint (usage telemetry, token counts only)
• No inbound network access is required in your AWS account
• No VPC, security groups, or network infrastructure is deployed

Supply Chain Security

• Installer packages are signed and distributed via nexus.allcode.com over HTTPS
• Package checksums are published for verification
• No third-party dependencies are bundled that require network access
• Updates are distributed through the same secure channel

Incident Response

In the event of a security incident:

• AllCode will notify affected customers within 72 hours
• Contact security@allcode.com to report vulnerabilities
• Emergency revocation: Delete the CloudFormation stack to immediately revoke all access

Frequently Asked Questions

Can AllCode access my AWS account? No. The CloudFormation stack creates resources owned by you. AllCode has no IAM access to your account.

Can AllCode read my code or conversations? No. All Claude Code interactions go directly to Amazon Bedrock in your account. AllCode only receives anonymized usage metrics (token counts).

What happens if I delete the stack? All Nexus resources are removed from your account. Users lose access immediately. Your Nexus portal data (metrics history, policies) is retained until you cancel your subscription.

Is the credential helper open source? The credential helper is distributed as a signed binary. Source code is available for security review upon request under NDA.

Next Steps

• CloudFormation Stack Details
• Deployment Guide