Trust Centre
Data Processing Addendum
What the DPA covers, in plain language. The full executable template is available on request for your legal and procurement teams.
Nuromi's Data Processing Addendum sets out the controller and processor roles, authorised sub-processors, the security measures we apply, how breach notification works under the Notifiable Data Breaches scheme and GDPR, how we assist with data subject rights, and international transfer safeguards. This page summarises it; the full DPA template is available on request.
What the DPA covers
Roles
You are the data controller of the personal information you upload or connect. Nuromi is the data processor, handling that information only on your documented instructions to provide the service.
Sub-processors
The DPA authorises the sub-processors that help run Nuromi and commits us to flow-down obligations. The current list is published on the sub-processor register, and customers can request advance notification of changes.
Security measures
TLS 1.3 in transit and AES-256 at rest, database-level Row-Level Security for tenant isolation, role-based access, passwordless sign-in by default with optional phishing-resistant passkeys and self-chosen passwords held only as salted hashes, sign-in tokens for systems connected through Nango, our OAuth broker, held by Nango, every other connection's credentials (Deputy's sign-in tokens, customer-provided API keys and the tokens obtained with them) stored in our database and readable only by Nuromi's servers, and database access restricted to Nuromi's engineering team.
Breach notification
In the event of an eligible personal data breach, Nuromi, as your processor, notifies you as soon as practicable with what happened, what data was involved, and what we changed. You, as the controller, decide on and make any notification to affected individuals and the OAIC under the Notifiable Data Breaches scheme of the Privacy Act 1988. Where GDPR applies, the supervisory authority is notified within 72 hours.
Data subject rights
We assist you in responding to data subject requests: access, correction, portability, and erasure. You can export your data in CSV or JSON at any time and request deletion of your data or account.
International transfers
Australian customer data is hosted in region by default (Supabase Sydney, Vercel Sydney edge). Where sub-processors operate outside your region, the DPA relies on appropriate transfer safeguards. US, UK, and EU residency options are available on request.
Request the full DPA template
We are happy to provide the full Data Processing Addendum for review and signature. Email support@nuromi.ai and we will send it over.
Related: the sub-processor register, the data residency page, and the privacy policy.