Security & trust
Your business partner should also be a trusted one
Nuromi is designed to protect the operational information at the centre of your business. Australian customers are hosted on Sydney infrastructure, data is encrypted in transit and while stored, and your business data is not used to train public AI models. Here is exactly how, in plain English or in full technical detail.
The journey of your data
Who's reading? Switch the explanation.
Australian data residencyap-southeast-2
Your stored business records and documents are held in an Australian database by default. Some processing happens elsewhere: the AI, payments, connector sign-in and email run outside Australia, and background jobs and error reports run on providers whose region we have not yet confirmed.
End-to-end encryptionTLS 1.3 · AES-256
Scrambled the second it leaves your device and while it's stored. Unreadable to anyone but you.
AI sees summaries, not recordsno training
Spreadsheets and connected systems are summarised before the AI reads anything. The one exception: documents you upload for it to read, like a plan or a P&L. Never used to train AI.
Tenant isolationPostgres RLS
Your business's data is walled off from every other customer's, CPC's included. The one exception is Nuromi's administrative key, held by our founders.
Passwordless by defaultmagic link + passkeys
Magic-link sign-in is the default, so most people never touch a password. Prefer more? Add a passkey (Face ID, Touch ID) or set your own password in Settings, never stored by us.
Activity visibilityactor · time · IP
Sign-ins and page activity are recorded, visible on your own Activity page. We do not yet log every settings or connector change as one trail, that is in progress.
The full detail
Built for enterprise. Trusted by clients.
Your operational data is sensitive. Every decision we made in building Nuromi was made with that in mind, privacy by design, not privacy by policy. Here is exactly how your data is protected.
Your database is hosted in your region
Nuromi is hosted on regional infrastructure. For Australian customers that's Supabase Sydney (AWS ap-southeast-2) and Vercel Sydney edge. Your stored records and compliance documents are held in that Sydney database. AI, payments, connector OAuth and email are handled by subprocessors that operate outside the region. Background jobs run on Inngest, which keeps each job step's result, which for a generated report is the report file itself, and error reports go to Sentry with request bodies, cookies and recognised identifiers and secrets removed before sending, though the text of an error message itself is kept; we have not yet confirmed the region either one stores data in. The register of the other providers is at /trust/subprocessors. Built to align with the Australian Privacy Act 1988 and the Australian Privacy Principles from day one. US, UK and EU residency available for international customers.
End-to-end encryption
All data in transit is protected with TLS 1.3. All data at rest is encrypted with AES-256. This applies to every piece of information Nuromi handles: financial records, attendance, inspection scores, staff compliance status and incident data.
Data minimisation architecture
When the AI analyses your business data, it does not receive your raw records. Spreadsheets and connected systems are profiled and aggregated server-side into totals, counts, and trends, and only that aggregated context crosses the boundary to the AI. Individual rows, client names, employee names, and addresses stay on our infrastructure. Documents you upload to be read as documents (a PDF or a business plan) are the one exception: the AI reads the document itself to extract its figures. This is an architectural constraint, not a policy.
Your raw records never reach AI models
Nuromi's AI, from strategic insights to routine summarisation and document reading, runs through OpenRouter on US-headquartered model hosts, with zero data retention requested on every model call and only on hosts that do not train on prompts. Text is first extracted from PDFs by Mistral AI, a step the zero-data-retention request does not cover. Voice-note transcription (only for customers with voice notes enabled) runs on Deepgram, with every request opted out of Deepgram's model-improvement programme so audio is kept only for as long as it takes to process it. From your structured data, what crosses to a model is aggregated context, totals, counts and trends, never individual rows, client names or employee details. Documents you upload to be read as documents are the one exception: the model reads that file to extract its figures. Everything else stays on our infrastructure, enforced by architecture, not policy.
Isolated from every other business, CPC included
Nuromi is built by the team behind CPC, a commercial cleaning company, and CPC uses Nuromi as one customer in its own workspace. A login can belong to only one workspace. Row-Level Security confines anyone signed in to their own workspace, and the queries the product runs for you are filtered to your workspace as well, so no other customer, CPC included, can open yours. If you run client portals, each of your clients sees only their own data. Two features can show a workspace's figures to a linked account, an advisor portfolio and a head-office view of member schools. Nuromi's team creates every advisor link, and a school joins a head-office view only through Nuromi's own provisioning, run by our team or triggered by an owner or admin of a head-office account. The exception is Nuromi's administrative database key, which the service needs to run background work: it can technically read any workspace. It is held by Nuromi's founders, and we do not yet keep a per-read record of that access.
Granular role-based access
You control who sees what. Your workspace is isolated from every other customer's, in the database and in the application, regardless of how permissions are configured. Within your workspace, every dashboard module page and the AI assistant honour each person's data-area grants: a member without the Finance grant cannot open Finance or read its figures, and the assistant refuses the question rather than guessing.
Passwordless by default
Magic-link sign-in is the default, and the only way to create an account, so most employees never set a password at all. Anyone who wants a faster or stronger sign-in can add a passkey (Face ID, Touch ID, or Windows Hello), which is phishing-resistant by design, or set an optional password of their own in Settings. Either way, nothing is stored by Nuromi itself: any password chosen is held only as a salted hash by Supabase Auth, our authentication provider, never in our own database.
Credential handling
Xero and the other systems you sign in to through Nango, our OAuth broker, keep their sign-in tokens with Nango; Nuromi's database holds only a reference to each connection. Every other connection's credentials are stored in our Sydney database: Deputy's sign-in tokens (Deputy connects to Nuromi directly, without Nango), and any API key you provide along with any token Nuromi obtains with it. Credentials stored there are encrypted at rest, readable only by Nuromi's servers (never by a signed-in browser session), and used only to fetch your data. Database access is restricted to Nuromi's engineering team.
Activity visibility
Sign-ins are logged with a timestamp, IP address, and user agent, and page-level activity is recorded, both visible on your own Activity page. AI-generated reports are logged separately. We do not yet log every settings or connector change as one unified audit trail, that is in progress. In the event of an eligible data breach, Nuromi, as your processor, notifies you as soon as practicable with what happened, what data was involved and what we changed. You, as the controller, decide on and make any notification to affected individuals and the OAIC under the Notifiable Data Breaches scheme of the Australian Privacy Act 1988; where GDPR applies, the supervisory authority is notified within 72 hours.
No vendor lock-in
Your data is exportable in standard formats at any time. If you ever want a full extract (records, attendance, compliance logs) you get it immediately in CSV or JSON. Payment data is handled exclusively by Stripe (PCI DSS Level 1); Nuromi never stores or processes card numbers.
Security questions from your IT or compliance team?
We're happy to walk your technical stakeholders through the architecture, complete a security questionnaire, or provide documentation for procurement and due diligence.
Subprocessors: Supabase (AU, SOC 2 Type II) · OpenRouter · Mistral AI · Deepgram · Stripe (PCI DSS Level 1) · Vercel · Nango · Resend