We will be undergoing planned maintenance on Oct 7th 6:00AM UTC / Oct 7th 2:00AM ET

NEXO

When evidence is chaos, NEXO makes it something you can actually show.

Comment

NEXO

When evidence is chaos, NEXO makes it something you can actually show.

NEXO helps people facing digital harassment, privacy violations, or misuse of their personal data turn scattered digital evidence into a clear, reviewable, and verifiable case.

It does not replace a lawyer. It helps you arrive prepared.

Inspiration

When something serious happens online, the evidence rarely looks like evidence.

It looks like screenshots buried in a phone. Messages across different apps. Emails. PDFs. URLs. Dates you are trying to remember while stressed, scared, or unsure what matters.

The problem is not only understanding what happened.

NEXO was designed around a real handoff: from a distressed non-technical person with scattered digital material to a human professional who needs something structured, attributable, and reviewable.

The problem is turning that chaos into something another person can actually review.

A lawyer, an organization, a platform, or an authority needs to distinguish between what you actually have, what you remember or claim, and what can reasonably be concluded from it.

NEXO was built around that distinction.

Instead of producing a confident-sounding legal answer, it keeps evidence, personal statements, and derived inferences separate.

And when the evidence is not enough, NEXO says so.

What it does

You give NEXO what you have:

  • a message;
  • an email (.eml);
  • a PDF;
  • text;
  • your own account of what happened.

NEXO organizes those materials into a case graph while preserving where each piece of information came from.

It then evaluates the case against a versioned, source-cited legal bundle and can return three kinds of result:

Supported — the available evidence satisfies the modeled requirements, with the relevant statute shown.

Conditional — there may be a path, but something specific is still missing.

Negative — the requirements are not met, with the reason made explicit.

NEXO can then prepare materials for review, including requests, evidence packages, and portable exports.

The human remains in control. NEXO never submits or sends legal actions on their behalf.

Evidence that remains verifiable

Every artifact receives a SHA-256 fingerprint.

Exports and the exact legal bundle used for an evaluation are fingerprinted as well.

NEXO includes an independent verifier that can check those exports without trusting NEXO's own server or database.

The hash does not claim that a document is true.

It establishes something narrower and important:

these are the bytes that were preserved.

Built for real legal contexts

NEXO currently implements two Argentine legal bundles:

  • Ley 25.326 — personal data protection.
  • Ley 27.736 — digital violence.

These are not placeholder examples or generic AI-generated legal rules. They are versioned bundles built from captured legal sources.

Argentina is the first jurisdiction, not the intended boundary of the project.

The architecture is designed so additional jurisdictions can be implemented as independent legal bundles rather than flattening different legal systems into one generic rules engine.

This is not a prototype

NEXO has a Rust backend, PostgreSQL persistence, isolated file extractors, deterministic legal evaluation, an independent verifier, a bilingual web interface, and a real deployment.

The complete evidence-to-export path has been exercised against a real PostgreSQL database.

The public demo lets anyone walk through the workflow without credentials and download real generated artifacts and their SHA-256 manifest.

NEXO has also gone through multiple rounds of adversarial red-team review, and that process will continue as the project expands.

The goal is not to build something that looks convincing in a demo.

The goal is to build something whose claims survive scrutiny.

Challenges we ran into

One of the hardest problems was making NEXO fail closed.

If a legal requirement is missing, it must remain missing. The system cannot quietly turn uncertainty into a positive result because that produces a nicer user experience.

Negative and conditional outcomes therefore became first-class results rather than errors.

File handling created another adversarial boundary. A malformed PDF or .eml should not be able to hang the service, so extraction is bounded and isolated.

We also had to solve a less glamorous but equally important problem: making security understandable.

A real user should not need to understand authentication architecture, RFC 5322, canonical serialization, or cryptographic hashes just to preserve material that may matter to them.

What we're proud of

NEXO already has:

  • two fully wired Argentine legal bundles;
  • deterministic, explainable evaluation;
  • separation between artifacts, user assertions, and inference;
  • SHA-256 integrity across evidence and exports;
  • an independent verifier;
  • sandboxed and bounded extractors;
  • a tested evidence-to-export path;
  • a public browser demo;
  • a real backend deployment.

Multiple adversarial red-team rounds completed across the architecture, evidence pipeline, legal evaluation boundaries, and failure modes — with further rounds planned as NEXO expands.

But the part we care about most is simpler:

NEXO can say “I don't have enough evidence to conclude that yet.”

For a system operating around legal evidence, that is a feature.

What we learned

We found two easy failure modes:

helpful but overconfident, and honest but useless.

Neither is good enough.

The difficult third option is to remain useful while being explicit about exactly what is known, what came from the user, what came from an artifact, what was inferred, and what is still missing.

That principle ended up shaping the entire architecture rather than becoming a disclaimer added at the end.

What's next

Argentina is the starting point.

The next major step is implementing another jurisdiction as a genuinely independent legal bundle and testing whether the architecture survives that boundary without silently importing Argentine assumptions.

We also plan to add OCR for image-only evidence, improve self-service onboarding, expand real-world backend testing, and continue adversarial red-team rounds.

NEXO is intended to grow jurisdiction by jurisdiction and evidence type by evidence type.

Because when someone is already dealing with harassment, exposure, or misuse of their data, they should not also have to become a digital-forensics specialist just to take the first step.

Gather it. Preserve it. Understand what you have. Take it to someone who can help.

Access to Justice & Civic Tech y Digital Rights & Policy Tech

https://github.com/annatchijova/nexo APACHE 2 https://nexo-web-sigma.vercel.app/ https://nexo-web-sigma.vercel.app/demo

https://www.youtube.com/watch?v=9FJ-8g5eZz4 Please select 1080p quality when watching the video for the best viewing experience.

Built With

Share this project:

Updates

Submission history