Trust Centre
Trust, security, and compliance
Everything your IT, security, and compliance team needs to evaluate Nuromi, in one place. Privacy by design, not privacy by policy.
Nuromi stores Australian customer data in its Supabase Sydney database and serves the app from Vercel Sydney edge, encrypts it with TLS 1.3 in transit and AES-256 at rest, isolates every tenant in the database and the application, and sends the AI server-side aggregates rather than raw records, except for documents you upload to be read. This is the single place for IT, security, and procurement teams to evaluate how Nuromi handles data.
Trust shelf
How your data is protected
Australian data residency
Nuromi runs on regional infrastructure. For Australian customers that is Supabase Sydney (AWS ap-southeast-2) and Vercel Sydney edge. Your stored records and compliance documents are held in that Sydney database. AI, payments, connector sign-in and email run outside Australia, and background jobs (Inngest) and error reports (Sentry) run on providers whose region we have not yet confirmed. Built to align with the Australian Privacy Act 1988 and the Australian Privacy Principles. US, UK, and EU residency is available on request.
Encryption in transit and at rest
All data in transit is protected with TLS 1.3. All data at rest is encrypted with AES-256. This applies to every piece of information Nuromi handles, from financial records to attendance, inspection scores, and incident data.
Data minimisation and how AI uses your data
When the AI analyses structured data, it does not receive your raw records. Spreadsheets and connected systems are profiled and aggregated server-side into totals, counts, and trends, and only that aggregated context crosses to the AI. Documents you upload to be read as documents are the one exception: the AI reads the document itself to extract its figures. Every AI model call requests zero data retention and goes only to model hosts that do not train on prompts. Text is first extracted from PDFs by Mistral AI, a step the zero-data-retention request does not cover. Voice-note transcription, only for customers with voice notes enabled, runs on Deepgram with every request opted out of Deepgram's model-improvement programme, so audio is kept only for as long as it takes to process it.
Tenant isolation
A login can belong to only one workspace. Row-Level Security confines anyone signed in to their own workspace, and the queries the product runs for you are filtered to your workspace as well, so no other customer, CPC included, can open yours. If you run client portals, each client sees only their own data, regardless of how permissions are configured. Nuromi's administrative database key, held by our founders, can technically read any workspace.
Role-based access
You control who sees what. Your workspace is isolated from every other customer's, in the database and in the application, regardless of how permissions are configured. Within your workspace, every dashboard module page and the AI assistant honour each person's data-area grants: a member without the Finance grant cannot open Finance or read its figures, and the assistant refuses the question rather than guessing.
Passwordless by default
Magic-link sign-in is the default and the only way to create an account, so most people never set a password. Team members who want a faster or stronger sign-in can add a passkey (Face ID, Touch ID, or Windows Hello), which is phishing-resistant by design, or set an optional password of their own choosing in Settings. Any password chosen is stored only as a salted hash by our authentication provider, Supabase Auth, never in our own database.
Credential handling
Xero and the other systems you sign in to through Nango, our OAuth broker, keep their sign-in tokens with Nango; Nuromi's database holds only a reference to each connection. Every other connection's credentials are stored in our Sydney database: Deputy's sign-in tokens (Deputy connects to Nuromi directly, without Nango), and any API key you provide along with any token Nuromi obtains with it. Credentials stored there are encrypted at rest, readable only by Nuromi's servers (never by a signed-in browser session), and used only to fetch your data. Database access is restricted to Nuromi's engineering team.
Activity visibility and breach notification
Sign-ins are logged with a timestamp, IP address, and user agent, and page-level activity is recorded, both visible on your own Activity page. AI-generated reports are logged separately. We do not yet log every settings or connector change as one unified audit trail, that is in progress. In the event of an eligible data breach, Nuromi, as your processor, notifies you as soon as practicable with what happened, what data was involved, and what we changed. You, as the controller, decide on and make any notification to affected individuals and the OAIC under the Notifiable Data Breaches scheme of the Privacy Act 1988; where GDPR applies, the supervisory authority is notified within 72 hours.
Data export and no lock-in
Your data is exportable in standard formats at any time. A full extract in CSV or JSON is available immediately. Payment data is handled exclusively by Stripe (PCI DSS Level 1); Nuromi never stores or processes card numbers.
Trust summary
Plain-language answers to the questions security and procurement teams ask most.
- Is Nuromi SOC 2 certified?
- Not Nuromi itself: Nuromi does not hold, and does not claim, a SOC 2 attestation of its own. It is built on SOC 2 Type II infrastructure, in that the hosting and database layer underneath it is covered by Supabase's attestation. See the compliance roadmap.
- Is Nuromi ISO 27001 certified?
- No. ISO 27001 certification is on the roadmap, to be pursued through a compliance automation platform such as Vanta at some point. No auditor is engaged and there is no target date. We do not claim ISO 27001 certification today.
- Is a Data Processing Addendum available?
- Yes. A DPA summary is published at /dpa and the full DPA template is available on request by emailing support@nuromi.ai.
- Who are Nuromi sub-processors?
- Supabase (database and authentication, Sydney), OpenRouter (AI model routing, sent only to US-headquartered hosts with a zero-data-retention policy, zero data retention requested on every call), Mistral AI (text extraction from uploaded PDFs), Deepgram (voice-note transcription, only when enabled, every request opted out of Deepgram's model-improvement programme), Stripe (payments, PCI DSS Level 1), Vercel (hosting), Nango (connector OAuth), and Resend (transactional email). Inngest (background jobs) keeps the result of each job step, which for a generated report is the report file itself, and Sentry (error diagnostics) receives error reports with request bodies, cookies and recognised identifiers and secrets removed before sending, though the text of an error message itself is kept. Neither is in the register yet, and we have not yet confirmed the region of either, as described in the privacy policy. The register is at /trust/subprocessors.
- How does Nuromi use my data with AI?
- For structured data, only server-side aggregates (totals, counts, trends) are sent to the AI, never raw records. Documents you upload are read directly by the AI, with zero data retention requested on every model call, and only on model hosts that do not train on prompts. Text is first extracted from PDFs by Mistral AI, a step the zero-data-retention request does not cover. There is no Google Gemini fallback. Voice-note transcription, only for customers with voice notes enabled, runs on Deepgram with every request opted out of Deepgram's model-improvement programme, so audio is kept only for as long as it takes to process it.
- How is data encrypted?
- TLS 1.3 in transit and AES-256 at rest, applied to all data Nuromi handles.
- How is access controlled?
- Row-Level Security in the database, and queries made on your behalf filtered to your workspace in code, isolate every tenant. Within a tenant, every dashboard module page and the AI assistant honour each person's data-area grants: a member without the Finance grant cannot open Finance or read its figures, and the assistant refuses rather than guessing. Magic-link sign-in remains the default, so most accounts never have a password to protect. Anyone who opts into a passkey, which is phishing-resistant by design, or an optional password stores nothing with us directly: Supabase Auth, our authentication provider, holds any password only as a salted hash. Sign-in tokens for systems you connect through Nango, our OAuth broker, are held by Nango; every other connection's credentials (Deputy's sign-in tokens, and any API key you provide with the tokens Nuromi obtains from it) are stored in our database, readable only by Nuromi's servers; database access is restricted to Nuromi's engineering team.
- What is your incident response and breach notification?
- Sign-ins and page-level activity are logged and visible on your Activity page; we do not yet log every settings or connector change as one unified audit trail. In the event of an eligible data breach, Nuromi, as your processor, notifies you as soon as practicable with what happened, what data was involved, and what we changed. You, as the controller, decide on and make any notification to affected individuals and the OAIC, as the Notifiable Data Breaches scheme of the Privacy Act 1988 requires; where GDPR applies, the supervisory authority is notified within 72 hours.
Sub-processors
The vendors that help run Nuromi. The register, with regions and certifications, is at /trust/subprocessors.
Explore the Trust Centre
Documentation for due diligence
The DPA template and the sub-processor register above are available now, on request. An independent penetration test is on our roadmap and Nuromi holds no SOC 2 attestation of its own. The compliance roadmap lists what is on the roadmap. We do not have a penetration test report to share yet. Under a mutual non-disclosure agreement, we are also happy to walk your technical team through the architecture directly.
Need a security questionnaire completed?
We are happy to walk your technical stakeholders through the architecture, complete a security questionnaire, or provide documentation for procurement and due diligence.
Request a security questionnaireThird-party data
Based on Australian Bureau of Statistics data. State and territory boundaries used in map-style dashboard widgets are derived from the ABS Australian Statistical Geography Standard (ASGS), licensed under Creative Commons Attribution 4.0 International.