Built for public discovery without losing control.
Listings are intentionally public, but the platform behind them needs strong boundaries. Nexez separates marketing, authenticated app, and public agent runtime surfaces so each part has the right security posture.
3
Separated domains
RLS
Database access model
SSL
Custom domain checks
Three separated surfaces
nexez.ai
Public education + discovery
app.nexez.ai
Authenticated creation + billing
nexez.app
Crawlable agent listings + APIs
Platform boundaries
The public listing is not the private dashboard.
Public listings expose only the business information users choose to publish. Authenticated settings, billing, API keys, drafts, imports, and analytics stay inside the product surface.
Auth-gated controls
Sensitive dashboard routes require a signed-in user and server-side checks.
Publish intent
Only published listings and public artifacts are served to crawlers.
Host-aware routing
Marketing, app, and agent runtime routes resolve to their intended domains.
Payments and integrations
External systems stay scoped.
Stripe, Calendly, Shopify, Square, and API access are treated as integration surfaces with explicit tokens, webhook paths, and user-controlled connection states.
Stripe readiness
Billing and platform fees are separated from public listing browsing.
Webhook hygiene
Webhook secrets live in environment variables, not in public client code.
Connection visibility
Users can see integration state and imported data before publishing.
Crawlability controls
Open where it matters, controlled where it counts.
Agent-facing listings are designed to be found. App routes are designed to stay out of search. Robots, sitemaps, and public manifests follow that split.
Agent-friendly robots
Public runtime welcomes major AI crawlers and standard search bots.
No-index app host
Authenticated product surfaces are kept out of search indexes.
Structured artifacts
llms.txt, agent.json, OpenAPI, and MCP artifacts make machine access explicit.
Questions
FAQ
Will unpublished listings be crawled?
No. The public runtime is built around published records and explicit public artifacts.
Can users verify custom domains?
Yes. Custom domains use verification checks before they are marked live.
Should secret keys appear in settings text?
No. User-facing settings should explain outcomes, not expose operational secret names.
Public to agents. Private where it should be.
Nexez gives businesses a discoverable public surface without turning the dashboard into a public target.