Trust Centre
Compliance
What we have in place today, and what we are working towards. We state only what is true now, and are explicit about what is still on the roadmap.
Today Nuromi aligns with the Australian Privacy Act 1988 and the Australian Privacy Principles, applies GDPR-aligned handling, meets PCI DSS through Stripe, and runs on SOC 2 Type II infrastructure via Supabase. ISO 27001 and an IRAP assessment are on the roadmap, with no target date; Nuromi does not claim a SOC 2 attestation of its own.
In place today
These frameworks apply to Nuromi as it operates now.
Australian Privacy Act 1988 / APPs
In place- Scope
- Collection, storage, use, and disclosure of personal information for Nuromi as a service.
- Evidence and access
- Privacy policy and data handling practices aligned with the Australian Privacy Principles from day one.
GDPR alignment
In place- Scope
- Rights of access, correction, portability, and erasure for customers and data subjects in the EU and UK.
- Evidence and access
- Privacy policy sets out GDPR-aligned handling; available on request for procurement review.
PCI DSS Level 1
In place- Scope
- Payment card handling for Nuromi subscriptions.
- Evidence and access
- Payments are processed exclusively by Stripe. Nuromi never stores or processes card numbers.
SOC 2 Type II (infrastructure layer)
In place- Scope
- Hosting and database infrastructure underneath Nuromi, via Supabase.
- Evidence and access
- Supabase's own SOC 2 Type II attestation covers the infrastructure layer. Available on request.
On the roadmap
We intend to pursue these, likely through a compliance automation platform such as Vanta. No auditor or assessor is engaged yet, work has not started, and we are not publishing a target date. We will update this page when that changes.
ISO 27001
On the roadmap- Scope
- Information security management system certification for Nuromi.
- Evidence and access
- On the roadmap. We intend to pursue this through a compliance automation platform such as Vanta; no auditor is engaged yet and there is no target date.
IRAP assessment
On the roadmap- Scope
- Assessment against the Australian Government Information Security Registered Assessors Program controls.
- Evidence and access
- On the roadmap, with no target date. Referred to as IRAP assessed, not IRAP certified.
Documentation for procurement
We are happy to walk your team through the architecture directly or complete a security questionnaire, under a mutual non-disclosure agreement where needed. ISO 27001 is on our roadmap, see above, and so is an independent penetration test; we do not have a completed report for either to share yet, and Nuromi holds no SOC 2 attestation of its own. Email support@nuromi.ai. See also the Trust Centre and the Data Processing Addendum.
Compliance questions
- Is Nuromi SOC 2 certified?
- Not Nuromi itself: Nuromi does not hold, and does not claim, a SOC 2 attestation of its own. It is built on SOC 2 Type II infrastructure, in that the hosting and database layer underneath it is covered by Supabase's attestation.
- Is Nuromi ISO 27001 certified?
- No. ISO 27001 certification is on the roadmap, to be pursued through a compliance automation platform such as Vanta at some point. No auditor is engaged and there is no target date. We do not claim ISO 27001 certification for Nuromi today.
- Is Nuromi IRAP assessed?
- No. An IRAP assessment is on the roadmap, to be pursued through a compliance automation platform such as Vanta at some point. No assessor is engaged and there is no target date. We describe this as IRAP assessed rather than IRAP certified, in line with how the program works.
- What is in place today?
- Today, Nuromi aligns with the Australian Privacy Act 1988 and the Australian Privacy Principles, applies GDPR-aligned handling, meets PCI DSS through Stripe for payments, and runs on SOC 2 Type II infrastructure via Supabase. The rest of the frameworks are on the roadmap.