Indian registry checks
Company register (MCA), PAN, GST returns, litigation and PEP through Surepass, for Indian vendors of UAE firms.
The platform
Eight engines. Try every one.
Each section has a demo that runs in your browser with fictional data. Panels for features still in build are labelled Preview.
NexaVerify · onboarding checks Live
UAE onboarding checks, before anyone signs or pays.
Trade licence, TRN, IBAN, beneficial owner and sanctions screening for UAE vendors, alongside the registry and bank checks NexaPair already runs for Indian vendors. Each row says whether that check is live in the product or runs on this site as a format check.
Try it: verify a vendor in one click.
Fictional vendors · no live registry call · IBAN and TRN rows are real format checksFormat checks you can run here Format check
These run in your browser and send nothing anywhere. They test structure only, not whether the number is registered or who holds it.
What it gives you
Indian bank-account owner
A test deposit through Meon confirms who owns the account. Aadhaar eSign for documents.
Sanctions and PEP
Consolidated sanctions and politically exposed person lists through OpenSanctions, re-checked while the vendor is active.
UAE trade licence
Licence status and expiry, mainland or free zone.
TRN
Tax registration confirmed for VAT and corporate tax.
Beneficial owners
Who ultimately owns or controls the vendor, compared with what the vendor declared.
UAE Local Terrorist List and UN list
Screening of the company, owners and directors against the lists UAE firms must apply.
Used by: Procurement at intake, Finance before payment, Compliance for due diligence.
NexaGraph · relationship intelligence Live
See the connections between vendors and your own staff.
Shared directors, bank accounts, phone numbers and addresses across your vendors and employees, found while you type and before the vendor is saved.
Try it: type a new vendor.
Live matching against fictional staff and vendorsWhat it gives you
Links to your own staff
Phones, addresses, bank accounts and similar names matched against your employee list.
Duplicate and linked vendors
Shared directors, tax numbers and bank accounts across your vendor base.
Explain, confirm, dismiss
Every link comes with its evidence. Confirmed related parties go to the Board.
Shared subcontractors
Where many vendors rely on the same providers behind the scenes.
Used by: Procurement and HR to keep conflicts out, Compliance and the Board to approve related parties.
NexaScore · explainable risk Live
Explainable risk, point by point.
Every factor is shown with its weight, beside minimum-tier rules you can audit. The tier decides the due diligence, the review cycle and the approvals.
Try it: describe a vendor and watch the score explain itself.
Illustrative weights and rules · your institution sets its ownWhat it gives you
A score with reasons
Every factor and weight visible, and set by your own risk model.
Minimum-tier rules
Floors for sensitive data, sanctions findings and staff links that no total can override.
Due diligence by tier
The tier opens the right case, with the right checks and review cycle.
Critical operations and resilience
Vendors mapped to critical operations, with recovery time checked against your tolerance.
Used by: Risk to own the model, Information Security and Operations to set access and resilience, Audit to test it.
NexaSentinel · always-on monitoring Live
Always watching, with a clock for your regulator.
Sanctions lists, filings, court records and financial health are checked every day, and each change becomes an alert for the vendor's owner. When a vendor incident touches a critical operation, the reporting clocks for your regulator start.
Try it: make something happen to a vendor.
Fictional vendors · demo clock: 1 second = 10 minutes
What it gives you
Daily monitoring
Sanctions, GST filing, litigation and financial-health changes, checked across every active vendor.
Alerts with an owner
Each alert goes to the person who owns the vendor. It is taken, worked and closed with a note for the audit trail.
Incident records
Each vendor incident is logged with its impact, actions and lessons learned, linked to the vendor.
Incident reporting clocks
Clocks that start when an incident touches a critical operation, with drafts ready for approval. Live for each UAE regime you select, from the CBUAE's 4-hour notice to the rules that say "immediately".
Used by: Compliance for sanctions, Finance for tax and credit, Legal for court cases, and Operations for incidents.
NexaPilot · AI under your control Live
AI that earns the right to act.
Today NexaPilot reads and drafts for your analysts. Next, it decides in the background while its accuracy is measured. It acts on its own only in categories where it has proved itself, and only if you allow it.
- L1 · AssistLiveWrites risk briefs, triages hits and explains links. A person decides.
- L2 · ShadowRoadmapDecides quietly and is scored against your analysts, category by category.
- L3 · ProposeRoadmapPre-fills the decision and its reasons. One click to confirm or override.
- L4 · Auto-clearRoadmapClears low-risk hits only in proven categories, with samples sent for review.
Try it: set the bar NexaPilot has to clear. Preview
Preview of L2 to L4 · shadow-mode results are illustrativeWhat it gives you
Your choice of model
Built-in analysis, Claude, OpenAI, Azure OpenAI, or a private model in your own environment.
Privacy by default
Emails, phone numbers and bank accounts are removed before sending. Keys are encrypted with AES-256-GCM.
Briefs, triage and explanations
Switched on feature by feature. Every output is labelled as AI, and a person makes the decision.
Shadow mode and auto-clear
Accuracy measured per category, autonomy only where you allow it, and an automatic step back if it drifts.
Used by: Risk and Compliance heads to set the bar, Internal Audit to test it, and the Board risk committee to approve it.
Resilience · critical operations, exits and change Live
Critical operations, exit plans and notice before change.
Map each critical operation to the vendors and subcontractors behind it, compare their recovery time with your tolerance, keep an exit plan for each, and stop a material change from going live before your regulator has been told.
Try it: check a critical operation.
Fictional data · live in the product
What it gives you
Critical-operations register
Each critical operation with its owner, tolerance and the vendors behind it.
Fourth-party mapping
The subcontractors behind each vendor, and where they overlap.
Equivalent resilience and concentration
Recovery times against tolerance, and single points of failure across operations.
Exit plans
A plan for each critical arrangement, with alternatives and a test date.
Notice before material change
A go-live gate that stays closed until the regulator's response is on file.
Master system of record location
A check that the master record stays where your regulator expects it.
Used by: Operations and business owners to map services, Risk to set tolerances, Legal and Compliance to handle notices.
Assess · questionnaires and evidence review Live
Questionnaires in Arabic and English, with AI evidence review.
Send vendors a questionnaire in the language they prefer. When the answers and evidence come back, the AI checks whether the evidence supports each answer, and a person decides.
Try it: review a vendor's answers.
Simulated AI review · fictional vendor and documentsWhat it gives you
Questionnaire library
Questionnaires in Arabic and English, sized to the vendor's tier.
AI evidence review
Each answer compared with the document behind it, with the reason shown.
A person decides
AI output is labelled, personal data is removed first, and an analyst signs off.
Full Arabic interface
The whole product in Arabic, for your teams and your vendors.
Used by: Information Security and Compliance to assess vendors, vendors themselves through the supplier portal.
Cyber posture · outside-in signals Live
Outside-in cyber posture, from public signals.
Passive checks of what any visitor can see: email security records, the certificate and TLS versions, security headers and security.txt. No port scanning, no probing, and nothing for the vendor to install.
Try it: check a vendor's domain.
Simulated in your browser · this page sends no request to the domain you enter
What it gives you
Email security records
MX, SPF and DMARC, which make it harder to impersonate a vendor by email.
Certificates, protocols and headers
Certificate trust and expiry, old TLS versions, the redirect to HTTPS, six security headers and security.txt.
Grade, history and alerts
An A to F grade, re-checked on a schedule set by tier. A drop raises an alert, and the grade can count in NexaScore if you choose.
Used by: Information Security to watch vendors from the outside, Procurement to see posture at intake.
Integrations Live
Plugs into the systems you already run.
Vendor requests come in from your ERP and procurement tools. Risk tiers, payment holds and alerts go back out. Connect today with the REST API, signed webhooks and exports. Native connectors are on the roadmap.
Pick a system to see what flows each way.
Three ways to connect, all live today
REST API
Create and update third parties, sync employees for conflict checks, and read scores and cases. Keys are scoped by role, with OpenAPI documentation at /api/docs.
Signed webhooks
13 events, each signed with an HMAC-SHA256 signature and logged with its delivery result. Teams and Slack formats are built in.
Registers as CSV or JSON
Ten registers, including the outsourcing register, alerts, findings, contracts and the audit trail.
For your developers
See exactly what a webhook sends.
Check the signature (Node.js)
const crypto = require('crypto');
function verify(header, rawBody, secret) {
const parts = Object.fromEntries(
header.split(',').map((p) => p.split('='))
);
const expected = crypto
.createHmac('sha256', secret)
.update(parts.t + '.' + rawBody)
.digest('hex');
return parts.v1.length === expected.length &&
crypto.timingSafeEqual(
Buffer.from(parts.v1), Buffer.from(expected));
}Every delivery is logged in NexaPair with its response code, so you can see what arrived and send a test from Settings.
Data sources behind the checks
Every result is stored with where it came from and when.
Surepass
India's company register (MCA), PAN, GST returns, court cases and PEP checks.
Meon
Bank-account checks for Indian accounts: a small test deposit confirms the owner. Plus Aadhaar eSign.
OpenSanctions
Consolidated sanctions and politically exposed person lists, re-checked while the vendor is active.
Your own provider
Already pay for a screening or ratings service? A provider template connects any HTTP API to the same checks.
UAE registers
Trade licence, TRN and beneficial-owner checks for UAE vendors.
Need a connector we do not list? Tell us which system and what should flow.Talk to us