Automation disappears from the experience. It does not disappear from the evidence.
The legitimate objection to any platform that automates is: if the machine decides, how do I audit? It is the right question. The answer is that the technology disappears from the user's experience, but not from the organization's record.
The auditor's four questions
In an audited organization, evidence should not be a separate project.
Today, in most organizations, evidence is assembled three weeks before the audit: somebody queries databases, reconstructs histories and puts together an annex. That work disappears when the process produces it as a by-product.
| The auditor asks | The platform answers |
|---|---|
| "Why does this case have this deadline?" | The service level calculation is persisted on every case, with a step-by-step explanation available from the record itself. The analyst, the supervisor and the auditor all see it — without touching the database. |
| "Who changed what, and when?" | Unalterable history and audit logs across every data update, queryable, filterable and exportable — and a single query audits each user, under its own permission, separate from administration. It is one of the criteria the external auditor verified. |
| "Where did the assistant get that answer?" | Every AI-generated answer carries an openable citation to its source, plus a validation checking that what was asserted is genuinely in the retrieved material. |
| "Was the control executed?" | The process does not advance if it was not. And the record shows that it was, with owner and timestamp. |
| "Can the sample be repeated?" | A report returns a deterministic sample of its result — a percentage with a minimum of rows — and it stays the same for the whole calendar month, so a sampling audit is repeated on the same cases. Closure facts are kept per case for exactly that review. |
| "Could someone have widened the report?" | No. The conditions the designer fixed are enforced by the server when the report runs, reloads, exports or prints; the person consulting it fills in only what was left open. |
A note on precision: "unalterable" is the term used in the certified criterion. The record history is append-only and cannot be edited from the application.
For security, architecture and legal
Architecture, encryption and standards
| Isolation | Single-tenant: dedicated application services and database per client. None of your data in a shared database. |
| Deployment | SaaS operated by Dexon on Microsoft Azure · in your own Azure subscription — behind Azure Front Door with WAF, Private Endpoints to SQL, Key Vault, OpenAI and Storage, infrastructure as code and one package for every environment · on-premises, in your private cloud. Licences register with no Internet connection and take effect immediately. |
| Availability | Health probes with automatic recovery of the service and external availability tests, and integration execution spread across independent process servers that take work from a shared queue. Horizontal API scale-out, available from December 2026; platform upgrades without downtime, available from December 2026. |
| Identity | Federation with Entra ID, Active Directory or your identity provider, with multi-factor authentication. |
| Encryption | AES-256 in transit and at rest, with cryptographic authentication of every message, encrypted value and document · TLS 1.3 preferred, with the minimum version enforced by policy on every endpoint · TLS 1.3 database connection with certificate validation · additional browser↔server request encryption · secrets in the product’s own encrypted configuration, with the custody copy in Azure Key Vault. |
| Documentation | The product documentation ships with the installed version, verified against the code, with contextual help in the administration centre. |
| Standards | Own certification: PinkVERIFY, 12 processes. A security validation framework aligned with OWASP ASVS 5.0 and NIST SP 800-115, mapped to NIST CSF 2.0. The infrastructure certifications of the cloud service belong to Microsoft Azure as the provider. |
| Accessibility | WCAG 2.1 AA, with VPAT/ACR as formal evidence — submitted within the PinkVERIFY assessment as well. |
| Sustainability | Colombian BIC (Benefit and Collective Interest) company · UN Global Compact signatories · SDGs 8, 10 and 11. |
We deliberately distinguish three things: our own certification (PinkVERIFY), the cloud provider's certifications (Microsoft Azure's, which cover the infrastructure, not the application) and alignment with a framework (the security validation framework). If your process requires a current certificate for a specific standard, say so and we will answer precisely before the evaluation goes further.
How it fits
Your observability platform detects. Dexon makes it act.
More and more procurements ask for service management, operations and assets in a single scope, and observability usually appears within operations: distributed tracing, automatic instrumentation, synthetic and real-user monitoring.
That is where Dexon connects: it turns what your monitoring detects into an action with an owner and a deadline.
Our recommendation
Do not replace your observability platform. Connect it. Most organizations of a certain size already made that investment and it works: the problem is rarely detection, it is that what gets detected does not become an action with an owner and a deadline.
Dexon is the layer that receives those events, correlates them with the configuration and the affected service, creates the case under the conditions you define, assigns it, runs the runbook, measures, escalates and leaves the evidence.
Send us your requirements matrix
We answer it requirement by requirement, — native, configurable, through integration, or with its delivery date — with the corresponding evidence.