OneOps.AIOneOps.AI
TO CONNECT

Nucleus

Nucleus is the identity and authority layer that the other products depend on. It is the source of truth for who an operator, worker, and asset is, which external systems know about them, and what any of them touched. It runs on a uniformly HIPAA-eligible substrate with minimum-necessary PHI scoping at every agent boundary.
Read the docs

The data refinery

How Nucleus works

See scattered operational data become governed context for your team, your agents, and every OneOps product.

  1. 01 / 07

    Scattered sources

    Dispatch, scheduling, billing, telematics, plus every SOP, PDF, and scan. None of it agrees with the rest.

  2. 02 / 07

    Connectors bind them

    Connectors bind each source in place. Agents build new ones as sources appear.

  3. 03 / 07

    Checks, then judgment

    Scripted checks run first. Then agents tag, classify sensitivity, and file. When they are unsure, they ask.

  4. 04 / 07

    A person approves

    A person approves before anything becomes binding. Every change is versioned and revertible.

  5. 05 / 07

    Curated context out

    Curated context out: organized, labeled, sensitivity marked. AI reads less and gets more right, at lower cost.

  6. 06 / 07

    One governed foundation

    One governed foundation. Every OneOps product stands on it.

  7. 07 / 07

    Inside the perimeter

    Nucleus connects every product inside a HIPAA-eligible Google Cloud perimeter.

What it does

The capabilities this product gives an operator.
Source of truth for identity
Workers, assets, credentials, tenants, and business rules live in one canonical, effective-dated model. Asking what the system believed on a given date is a query, not a forensic project.
One substrate, one connected suite
Compliance Link, AI Studio, AI Operations, and everything you buy in the AI Marketplace run on the same canonical graph, so identity, access, and audit stay consistent across the suite.
Pooled multi-tenancy with row-level security
A tenant identifier on every row with database-enforced isolation. Application bugs cannot accidentally cross tenants because the database refuses to serve the rows.
Integration substrate
A connector catalog, manifest registry, transactional outbox, and credential broker live at the platform tier, ready for the products above to use.
Three tenant shapes
Private operator, public agency, and joint venture. The tenancy model is designed for partnerships, not just single companies.
Compliance-ready by design
Audit logging, role-based access, and encryption at rest give the substrate its security posture. PHI is assumed pervasive; every component gets a minimum-necessary, task-scoped, audit-logged view.

How it works

Identity-first and effective-dated, with tenant isolation enforced at the database.
Canonical data model
A small set of core entities, effective-dated, with sensitive columns flagged and separated from free-form metadata.
Tenant-scoped access
Row-level security keyed off a per-session tenant identifier, with role-based claims flowing into both the data layer and the dashboard.
Connector substrate
Every connector implements the same contract: manifest, inbound adapter, outbound adapter, reconciliation, and health probe.

See Nucleus in action

Watch the data refinery, or read the docs for the full picture.
Read the docs