Thomas Harrison
Thomas Harrison
Infrastructure · Security · Trust by Construction
Founder, Common Nexus

Twenty-seven years building systems people have to trust.

I built an IT function at a company that had none and ran it for thirteen years, across about a thousand servers, while the platform it served reached tens of millions of accounts and people in more than a hundred and forty countries. I co-founded an infrastructure and cybersecurity practice and built it around the organizations carrying the heaviest compliance obligations, running it as COO and then as President and CEO. Now I build software and systems with AI, and the controls that keep what they do reviewable. I build systems to be verified, and to keep their promises after the people who built them move on.

How I Build

  • I do not write the code. I feed the tooling the authoritative documentation, hold it to a standard rather than accepting the first answer, and build the gates that make its output trustworthy. Knowing how to specify what you need is the key, and testing that you got it is critical.
  • Nexa is the substrate I run my own work through, across Windows, Mac and Linux. Specialised agent offices coordinate through signed handoff envelopes, with heartbeats, liveness detection, a quarantine and a cross-host bridge.
  • nexus-council exposes seventy-two expert personas to that tooling, and I use it to reach decisions rather than to ratify them. Seats review code and design interfaces, and they are set against each other on purpose, so a choice has to survive the strongest argument for the opposite.
  • The change-approval gate is the piece I am proudest of. A panel must approve before a destructive operation runs, and the approval is a cryptographic token bound to the exact bytes of the script it authorises. A broken gate means the operation waits. It is change control for a world where the thing making the change is not a person.
  • I hold the most access here, so I should be the easiest to audit. My own administrative work runs behind approval gating, certificate authentication and a signed log.

Common Nexus

Nine months learning to use AI practically: to build software, to navigate systems, and to make them more secure. Common Nexus is where I do that on my own terms, and where the controls are mine to set.

Nexus Contacts keeps its data on the customer's own device and their own iCloud. No servers, nothing tracked.

Every backup the app writes opens with a plain-language description of its own structure, and an instruction block for whoever has to pull the data back out. Read the head of the file in any text editor and you know what you have and how to get it: no source code, no documentation, and no Nexus Contacts required.

Principles

Visibility is the first control
Compliance is a byproduct of architecture
Ownership must be explicit
Serve the mission, not the vendor
Systems shape behavior
Exposure you haven't mapped is exposure you can't govern
Clarity over complexity
Focus is rare and valuable
Generalists thrive in ambiguity

Background

Common Nexus
Founder · 2025–present
Nine months building software and systems with AI, and the controls that keep what they do reviewable. Shipped and operate Nexus Contacts on the App Store, a paid iOS product that keeps its data on the customer's own device and their own iCloud, no servers, nothing tracked. Stopped my own AI industry-intelligence product three months in, after concluding that general AI tooling was improving faster than the product could differentiate.
Madrone Technology Group
Founder & COO 2019–2025, then President & CEO 2025
An infrastructure and cybersecurity practice built around the clients carrying the heaviest compliance obligations: investment managers under FINRA, ITAR manufacturing, CMMC 2, HIPAA, and local governments operating critical infrastructure. Data center strategy, hybrid-cloud modernization and reliability architecture for regulated environments.
Together Labs (IMVU)
Sr. Engineering Manager · 2009–2022
IT, Operations and Security for a global consumer platform, over thirteen years. The full hardware and software lifecycle for both the employees and the customer-facing systems: on-premise infrastructure, data centers and edge networks, and the uptime and security of all of it.
Community Infrastructure
Co-Founder & Organizer · 2005–2024
Co-organized SuperHappyDevHouse from the first events in people’s homes through to venues at Sun, Palantir, Microsoft and Google, and helped build Hacker Dojo from early setup through board leadership. Two of Silicon Valley’s longest-running independent technical communities. Watch the documentary.
Rwanda National ISP Deployment
IT Consultant · 2004
A three-month national internet infrastructure deployment, running a six-person team on the ground. The mandate covered government facilities, schools and paying subscribers nationwide: hundreds of locations, dozens of them large buildings, with fiber, point-to-point wireless and WAN acceleration over a satellite uplink.

Outside the Work

I ride. I am training for an Ironman in 2027.