Trust Centre
Data residency
Where your data lives, what stays in region, and the residency options for international customers.
For Australian customers, Nuromi hosts data in Australia by default: the database runs on Supabase Sydney (AWS ap-southeast-2) and the application is served through Vercel Sydney edge. Your stored records and documents are held in that Sydney database; background jobs and error reports run on providers whose region is not yet confirmed. US, UK, and EU residency is available on request.
Australian by default
For Australian customers, your data is hosted in Australia by default. The database runs on Supabase in the Sydney region (AWS ap-southeast-2), and the application is served through Vercel Sydney edge. Records and compliance documents are stored in that database. Data is encrypted with TLS 1.3 in transit and AES-256 at rest, and Row-Level Security plus workspace-scoped queries keep every customer isolated. Nuromi is built to align with the Australian Privacy Act 1988 and the Australian Privacy Principles.
What stays in region
Your stored business data is held in the Sydney database. Two providers outside that database handle some of it: Inngest keeps the result of each background-job step, which for a generated report is the report file itself, and Sentry receives error reports with request bodies, cookies and recognised identifiers and secrets removed before sending, though the text of an error message itself is kept. When the AI analyses structured data, it does not receive your raw records: spreadsheets and connected systems are aggregated server-side into totals, counts, and trends, and only that aggregated context crosses to the AI. Documents you upload to be read as documents are the one exception, since the AI reads the document itself to extract its figures. This is an architectural constraint, not a policy.
Sub-processors by region
In region (Sydney)
- SupabaseDatabase and authentication in the Sydney region (AWS ap-southeast-2), including any API key you provide, encrypted at rest.
- VercelApplication served through Vercel Sydney edge for Australian customers.
Outside the region
- OpenRouterRoutes AI requests to US-headquartered model hosts. Receives only aggregated context for structured data. Uploaded documents are read directly, with zero data retention requested on every model call, and only on hosts that do not train on prompts. PDF text is first extracted by Mistral AI, which that request does not cover.
- DeepgramVoice-note transcription, only for customers with voice notes enabled, every request opted out of Deepgram's model-improvement programme so audio is kept only for as long as it takes to process it.
- StripeProcesses payments. Card details never touch Nuromi (PCI DSS Level 1).
- NangoManages OAuth connections to systems you choose to link.
- ResendSends transactional email such as sign-in links and receipts.
Region not yet confirmed
- InngestRuns background jobs such as data syncs, digests and report building. Keeps the result of each job step, which for a generated report is the report file itself.
- SentryReceives error reports with request bodies, cookies and recognised identifiers and secrets removed before sending, though the text of an error message itself is kept. Sentry may also record the IP address a report is sent from.
The vendors in the register have more detail on the sub-processor register.
Residency for international customers
US, UK, and EU residency is available on request for customers outside Australia. To arrange the right region for your organisation, email support@nuromi.ai.
Data residency questions
- Where is my data stored?
- For Australian customers, your records and compliance documents are stored in Australia by default: the database runs on Supabase in the Sydney region (AWS ap-southeast-2) and the application is served through Vercel Sydney edge. Some processing happens outside that database, and the providers involved are listed on this page.
- What stays in region, and what leaves it?
- Your stored business data (records, attendance, inspection scores, compliance status, incident data, and compliance documents) is held in the Sydney database. Background jobs (Inngest) keep the result of each job step, which for a generated report is the report file itself, and error reports go to Sentry with request bodies, cookies and recognised identifiers and secrets removed before sending, though the text of an error message itself is kept; we have not yet confirmed the region either provider stores data in. When the AI analyses structured data, it receives only server-side aggregates (totals, counts, trends), not raw records. Uploaded documents are the one exception: they are read directly by the AI to extract their figures.
- Which sub-processors are in region?
- Supabase (database and authentication) and Vercel (application hosting) serve Australian customers from the Sydney region. AI, payments, connector OAuth, and email are handled by sub-processors that operate outside the region. Background jobs (Inngest) and error reporting (Sentry) run on providers whose region we have not yet confirmed.
- Do you support residency outside Australia?
- Yes. US, UK, and EU residency is available on request for international customers. Contact us to arrange the right region for your organisation.
- Is this aligned with Australian privacy law?
- Yes. Nuromi is built to align with the Australian Privacy Act 1988 and the Australian Privacy Principles from day one, and applies GDPR-aligned handling for customers in the EU and UK.