Overview
Qwalora Governance is a hosted application for continuous access governance. It reads access from connected systems, compares it with approved access, raises findings, routes remediation through approval and records evidence of what happened.
The product is offered by Qwalora LLC. It was previously published under the name Nuxari; existing workspaces, records and integrations carry over unchanged.
Getting started
Access is by invitation. Your organization's administrator invites users, and each invitation is sent by email. Sign-in uses Qwalora Governance identity, which can federate to your organization's identity provider where single sign-on has been configured during onboarding.
Concepts
Approved access and actual access
Approved access is what your policies and recorded approvals say a person or service should hold. Actual access is what connectors observe in your systems. A difference between the two is drift.
Findings
Each instance of drift becomes a finding with a severity, an owner and a history. Findings close through remediation, a recorded acceptance, or a later observation showing the access is gone.
Remediation requests
A proposed change to a connected system, grouped in a remediation plan. A plan runs only after someone other than its author approves it.
Roles and approvals
Permissions are assigned by role within your organization's workspace. Administrators manage users, teams, connectors and policies. Approvers decide on remediation requests and can approve, reject, delegate or request more information. Auditors have read access to findings, history and evidence.
The person who requests a change and the person who approves it are recorded separately. Workspaces are separate: users of one organization cannot see another organization's data.
Connectors
Connectors are added by an administrator and authenticate with credentials or application consent that your organization grants. Credentials are stored encrypted and are not displayed after they are saved. Each connector can be tested, synchronized, disabled or have its credential rotated from the administration area.
Coverage differs by connector. See integration coverage for what each connector supports.
Edge agent
The edge agent collects information from hosts that cannot be reached from the internet. It is registered from the administration area, authenticates with an agent token, and makes outbound connections only, polling the service for tasks.
Evidence
Evidence packages collect requests, approvals and actions for a period or a control. Each package is signed with a key held by the service, and the product can check a package against its signature to detect alteration.
Evidence records produced before the Qwalora Governance name are kept exactly as they were generated, including their original names, so their hashes remain valid.
Support
Customers can reach support through their onboarding contact or at hello@qwalora.com. To report a security issue, see the security page. Platform status is published at status.nuxari.com until the status page moves to a Qwalora address.