AI & SaaS · Our Own Product 2023-2026

Nexo

Nexo is Kiwop's SaaS platform that brings together CRM, projects, invoicing and time tracking with AI agents that query data and execute tasks with permissions, human approval and traceability. Its ISMS module is what got us through the ENS, ISO 27001 and ISO 42001 audit without a single non-conformity.

3 years (ongoing) 6 specialists 2023-2026

Services

AI Agents
Laravel Development
React Development
API Integrations
UX/UI Design
DevOps

Related services

01The challenge

Companies use dozens of disconnected tools: CRM, project management, time tracking, invoicing... The result is data duplication, manual processes and zero real visibility. Nexo was born to solve this at home first: we wanted to run Kiwop with a single system that learned from our own data. We're our own first client, and that's the point: it's the same AI brain we build for whoever hires us.

02The solution

We developed Nexo as a multi-tenant platform with modular architecture: time tracking with legal compliance (4-year retention), project and task management, CRM with lead capture by email and invoicing synced with Holded. On top, a cross-cutting AI layer: an assistant that answers with the company's data through audited tools, and 27 proactive agents that monitor time budgets, invoicing, incoming mail and SEO, generate reports and propose actions. Every action with consequences requires human approval and is logged. Live integrations with Holded, Apollo, Slack and the Google APIs, plus importers for HubSpot, ClickUp and Asana. Laravel + React + Inertia.js stack on PostgreSQL with pgvector. In 2026 we added the ISMS module: the 73 measures of Spain's ENS (National Security Framework), the 93 controls of ISO 27001 and the 38 of ISO 42001, all in a single console, with a versioned documentation set, signed evidence, an immutable audit trail and an external auditor account. With it we passed OCA Global's certification audit in August 2026 across all three standards with zero non-conformities, and since September we've sold it to other companies as Nexo SGSI, as SaaS or self-hosted on their own infrastructure.

Tech stack

How it's built

Front end

React Reactive UI
Inertia.js SPA bridge

Engine

Laravel Back end & APIs
Holded API ERP & invoicing
Apollo API B2B data

AI

pgvector Vector search
Anthropic API Claude models via API
Claude Opus 4.8 Strategic LLM
Claude Sonnet 5 Workhorse LLM

Data

PostgreSQL Database
Redis In-memory cache

03Architecture

How a request flows

An event (a cron job, an incoming email, a user question) triggers an agent or the assistant
The system retrieves only the authorized context: every query is filtered by workspace and by the user's or agent's permissions
The model reasons and picks a tool from a catalog of 37: searching tasks, hours, leads, profitability, internal knowledge or data connectors
Read-only tools run directly; the ones that mutate something (write SQL, files, shell) require the user's explicit confirmation
Agent action proposals are born in a pending state and only run once a human approves them
Every call to the model and to each tool is logged: tokens, cost, duration and who approved what

What is AI and what is deterministic

AI components

The models (Claude Opus and Claude Sonnet, depending on each task's difficulty) interpret instructions, reason about the company's context, choose tools, draft reports and drafts, and propose actions. Routine agents run on the cheaper model and strategic ones on the most capable: model tiering is part of the design.

Deterministic components

Invoicing sync (Holded), time tracking and its 4-year legal retention, isolation between workspaces, role- and module-based permissions and business validations all run through conventional code. We never delegate to the LLM any operation that requires a deterministic outcome: the model proposes, the code decides what it can touch.

What the system does not do

No agent accesses data outside its workspace: isolation is enforced on the server (scopes, middleware and dedicated tests), not in the prompt
Every action proposal from an agent is born in a pending state and requires human approval before it runs
Tools that mutate data (write SQL, files, shell) require explicit confirmation and are restricted to authorized users
Time tracking and legal obligations run through deterministic logic, never through the model's inference
Every AI call is metered in an immutable log (tokens, cost, model) with a monthly budget per workspace that cuts off spending if it's exceeded

04Measured impact

Results

10+ Live integrations
90% Automated time entries
0 Non-conformities in ENS, ISO 27001 and ISO 42001
27 Active AI agents

Verifiable data

Metrics in detail

Months in production (platform / agent layer): 36 / 5
Projects managed: 166
Tasks managed: 2 022
Time entries (clock-ins): 2 478
Hours billed to client projects: 2 983 h
Time entries created via automated channels (API, task closure, git): 90%
Active AI agents: 27
Agent executions logged (since Feb 2026): 6 760
Model-to-tool calls logged: 466
Tokens processed by the AI layer: 142 M
Standards audited with the ISMS module (August 2026): 3
Non-conformities in the certification audit: 0
Measures and controls managed (ENS + ISO 27001 + ISO 42001): 204
Documents in the ISMS documentation set: 72

Methodology: Aggregated data extracted via a read-only query against Nexo's production database on July 10, 2026. The platform has been in production since July 2023 (it started as time tracking) and the AI agent layer since February 2026. These are platform-wide totals; they expose no client data. ISMS figures come from OCA Global's audit report (17-27 August 2026) and the module's catalogs as of August 28, 2026.

05The process

The process

Discovery

Operational workflow analysis and pain point identification
Architecture

Multi-tenant design on Laravel + Inertia (React) and integrations model
Core

Time tracking and project management
Integrations

Holded, Apollo, Slack and Google APIs live; importers for HubSpot, ClickUp and Asana
SaaS

Onboarding, billing and admin panel
AI Layer

Assistant with audited tools and proactive agents with human approval: reports, monitoring and proposals
ISMS

Compliance module for ENS, ISO 27001 and ISO 42001: catalogs, documentation set, signed evidence and an external audit passed with zero non-conformities (May-August 2026)

06Showcase

The platform

Nexo is not a demo: it is the system Kiwop runs on every day. CRM, projects, invoicing, AI agents, certified security and the portal each client sees, all on the same data.

01 · The pulse

Where the money is, what is being ignored and how the team is doing

Every morning Nexo summarises which payments are waiting, which tasks have been stalled for days and who has clocked in. An assistant answers with the company's data through audited tools, not by searching the inbox.

156projects managed, with hours, tasks and payments in a single view
02 · CRM and sales

Every lead with its next step

Leads by source, a pipeline weighted by probability and follow-ups with a date. The lead agent prepares the follow-ups and proposes the next step; a person decides whether it is sent.

302leads managed in the CRM
03 · Invoicing

Contracts, milestones and payments in one place

Recurring contracts, project milestones and invoices linked to the accounts. Each project's profitability is calculated from logged hours, not estimates.

90 %of hour allocations are done automatically
04 · The agents

27 agents with human approval

They monitor hour banks, invoicing, incoming email and SEO, generate reports and propose actions across 150 monitored projects. Any action with consequences requires a person's approval and is logged.

27AI agents active in production
05 · The ISMS

A management system audited against three standards

The 73 ENS measures, the 93 ISO 27001 controls and the 38 ISO 42001 controls managed from a single console. OCA Global certification audit passed in August 2026 with no non-conformities.

204measures and controls across the three standards, managed from one console
06 · The portal

And what your client sees

Each client logs into their portal: hours used, tasks, pending decisions with a deadline, deliverables to sign and measured results. No need to ask for a report: it is already there.

28clients with their own portal in Nexo