Skip to main content

Technical Glossary

This glossary defines the core concepts and terminology used across the Noxys platform. Understanding these terms is essential for developers, administrators, and security officers.

Core Concepts​

AIInteraction​

An AIInteraction is the fundamental unit of data in Noxys. It represents a single exchange between a user and a Generative AI platform (e.g., a prompt sent to ChatGPT).

  • What it contains: Metadata (timestamp, user ID, department, service name), classification signals (types of data detected), and the policy verdict (the action taken).
  • Privacy: Raw prompt content is never stored in an AIInteraction record; only its SHA-256 hash is retained for audit purposes.

Tenant​

A Tenant is a logical isolation boundary representing a single customer organization (e.g., "Acme Corp").

  • Isolation: Data, users, policies, and configuration are strictly scoped to a tenant and cannot be accessed by other tenants.
  • Configuration: SSO settings, data residency preferences, and billing are managed at the tenant level.

Policy​

A Policy is a governance rule defined by a Tenant Admin to control AI usage.

  • Logic: It follows a "Condition → Action" structure (e.g., If "Healthcare PII" is detected on "ChatGPT" → Action: "Redact").
  • Actions: The four standard actions are Block, Coach, Redact, and Log.

Architecture & Detection​

Tier​

In Noxys, a Tier can refer to two distinct concepts:

  1. Enforcement Tiers: The three deployment points where Noxys operates:
    • Tier 1 (Extension): Browser-based protection.
    • Tier 2 (Agent): OS-level protection (Desktop/IDE).
    • Tier 3 (Proxy): Network-level protection (BYOD/API).
  2. Classification Tiers: The depth of analysis (Tier 1: Local Regex, Tier 2: Backend ML, Tier 3: Async Deep Scan).
  3. Subscription Tiers: The commercial plans (Free, Starter, Business, Enterprise).

Plugin​

A Plugin (specifically a Site Plugin) is a modular component within the Noxys Browser Extension.

  • Purpose: Each plugin is tailored to a specific AI platform (e.g., a chatgpt.ts plugin). It knows how to "hook" into that platform's DOM to capture input before it is sent and inject UI elements like coaching overlays.
  • Dynamic Loading: Plugins are loaded dynamically only when the user visits a supported AI site, keeping the extension lightweight.

Recognizer​

A Recognizer is an atomic detection unit within the Detection Fabric.

  • Types: Recognizers can be Deterministic (Regex/Checksums), Heuristic (Behavioral patterns), or ML-based (Natural Language Processing / NER).
  • Responsibility: Each recognizer is responsible for identifying one specific entity type (e.g., FR_IBAN, US_SSN, API_KEY, INTENT_RECRUITMENT).

Vocabulary (LEXICON-1)​

Per ADR-015 (LEXICON-1), Noxys uses Risk Signals as the canonical top-level term for sensitive data detected in AI prompts. PII remains valid as a sub-category.

Risk Signals (top-level term)​

Risk Signals are the umbrella concept for any sensitive data detected by Noxys recognizers. Where older docs say "PII detection", new docs say Risk Signals detection.

Risk Signal sub-categories​

Every detected entity is classified into one of six sub-categories:

Sub-categoryCode valueExamples
PIIpiiEmail, phone, IBAN, NIR, names, addresses
SecretsecretAPI keys, bearer tokens, passwords
CodecodeSource code snippets, internal class names
IPipTrade secrets, formulas, internal docs
ConfidentialconfidentialStrategy, M&A, financials
Shadow AIshadow-aiUse of unsanctioned AI services

Migration status​

  • New text uses Risk Signals for the top-level term
  • PII remains valid when referring to the sub-category specifically
  • Legal templates (DPIA, GDPR Art 30 records) retain PII because GDPR Art 4 uses that exact term
  • Historical changelog and ADR file names are NOT retroactively renamed