Trust Centre
Data residency
Where your data lives, what stays in region, and the residency options for international customers.
For Australian customers, Nuromi hosts data in Australia by default: the database runs on Supabase Sydney (AWS ap-southeast-2) and the application is served through Vercel Sydney edge. Your stored records, logs, and documents stay in region. US, UK, and EU residency is available on request.
Australian by default
For Australian customers, your data is hosted in Australia by default. The database runs on Supabase in the Sydney region (AWS ap-southeast-2), and the application is served through Vercel Sydney edge. Records, logs, and compliance documents stay in region. Data is encrypted with TLS 1.3 in transit and AES-256 at rest, and Row-Level Security keeps every customer isolated. Nuromi is built to align with the Australian Privacy Act 1988 and the Australian Privacy Principles.
What stays in region
Your stored business data stays on in-region infrastructure. When the AI analyses structured data, it does not receive your raw records: spreadsheets and connected systems are aggregated server-side into totals, counts, and trends, and only that aggregated context crosses to the AI. Documents you upload to be read as documents are the one exception, since the AI reads the document itself to extract its figures. This is an architectural constraint, not a policy.
Sub-processors by region
In region (Sydney)
- SupabaseDatabase, authentication, and credential vault in the Sydney region (AWS ap-southeast-2).
- VercelApplication served through Vercel Sydney edge for Australian customers.
Outside the region
- AnthropicReceives only aggregated context for structured data. Reads uploaded documents directly, with zero data retention requested on every call, and does not train on customer data.
- DeepgramVoice-note transcription with zero data retention, only for customers with voice notes enabled.
- StripeProcesses payments. Card details never touch Nuromi (PCI DSS Level 1).
- NangoManages OAuth connections to systems you choose to link.
- ResendSends transactional email such as sign-in links and receipts.
Full detail is on the sub-processor register.
Residency for international customers
US, UK, and EU residency is available on request for customers outside Australia. To arrange the right region for your organisation, email hello@nuromi.ai.
Data residency questions
- Where is my data stored?
- For Australian customers, your records, logs, and compliance documents are hosted in Australia by default: the database runs on Supabase in the Sydney region (AWS ap-southeast-2) and the application is served through Vercel Sydney edge.
- What does "your data never leaves your region" mean?
- Your stored business data (records, attendance, inspection scores, compliance status, incident data, logs, and documents) stays on in-region infrastructure. When the AI analyses structured data, it receives only server-side aggregates (totals, counts, trends), not raw records. Uploaded documents are the one exception: they are read directly by the AI to extract their figures.
- Which sub-processors are in region?
- Supabase (database, authentication, and vault) and Vercel (application hosting) serve Australian customers from the Sydney region. AI, payments, connector OAuth, and email are handled by sub-processors that operate outside the region, receiving only what they need.
- Do you support residency outside Australia?
- Yes. US, UK, and EU residency is available on request for international customers. Contact us to arrange the right region for your organisation.
- Is this aligned with Australian privacy law?
- Yes. Nuromi is built to align with the Australian Privacy Act 1988 and the Australian Privacy Principles from day one, and applies GDPR-aligned handling for customers in the EU and UK.