Self-hosting cxOptima: a security architecture overview

For a bank or public institution, the first question about any customer experience platform isn't "what can it do?" — it's "where does the data live, and who can reach it?" cxOptima is built so the answer is always: inside your infrastructure, reachable only by the tier that needs it.

Two tiers, one trust boundary

cxOptima ships as two deployables built from one codebase:

• A perimeter tier — the customer and staff experience, the session layer and a thin proxy for embedded capabilities. It holds no database and no administrative secret.
• An internal tier — the application core and real-time events. It is the only tier that touches the database, and it is never internet-facing.

The perimeter tier calls the internal tier with a bearer token. Crucially, the internal tier re-verifies that token independently against the identity provider's published public keys. The two tiers don't simply trust each other — a compromised perimeter process still can't forge access to the internal tier.

Your data stays yours

• The database is internal-only and never exposed to the internet.
• Core-banking and customer data flow through the internal tier, never the perimeter.
• You bring your own identity provider, database, cache and object storage.
• Nothing needs to leave your network for cxOptima to run.

Governed, offline entitlements

Which capabilities are active travels in a signed, offline entitlement file the internal tier verifies locally. There's no call home and no runtime dependency on us — enforcement is soft by design, so an entitlement edge case never becomes a customer-facing outage.

Reviewing cxOptima for a security assessment? Start with the security overview, then talk to us.