Trust Centre
Data Processing Addendum
What the DPA covers, in plain language. The full executable template is available on request for your legal and procurement teams.
Nuromi's Data Processing Addendum sets out the controller and processor roles, authorised sub-processors, the security measures we apply, breach notification within 72 hours, how we assist with data subject rights, and international transfer safeguards. This page summarises it; the full DPA template is available on request.
What the DPA covers
Roles
You are the data controller of the personal information you upload or connect. Nuromi is the data processor, handling that information only on your documented instructions to provide the service.
Sub-processors
The DPA authorises the sub-processors that help run Nuromi and commits us to flow-down obligations. The current list is published on the sub-processor register, and customers can request advance notification of changes.
Security measures
TLS 1.3 in transit and AES-256 at rest, database-level Row-Level Security for tenant isolation, role-based access, passwordless sign-in by default with optional phishing-resistant passkeys and self-chosen passwords held only as salted hashes, OAuth tokens held in Supabase Vault with zero standing team access, and a full audit trail.
Breach notification
In the event of a confirmed personal data breach, affected customers are notified within 72 hours, in line with the Privacy Act 1988 Notifiable Data Breaches scheme and GDPR-aligned practice.
Data subject rights
We assist you in responding to data subject requests: access, correction, portability, and erasure. You can export your data in CSV or JSON at any time and request deletion of your data or account.
International transfers
Australian customer data is hosted in region by default (Supabase Sydney, Vercel Sydney edge). Where sub-processors operate outside your region, the DPA relies on appropriate transfer safeguards. US, UK, and EU residency options are available on request.
Request the full DPA template
We are happy to provide the full Data Processing Addendum for review and signature. Email hello@nuromi.ai and we will send it over.
Related: the sub-processor register, the data residency page, and the privacy policy.