Trust Centre
Sub-processor register
The third parties that help run Nuromi, what each does, where it operates, and its certifications.
The register below lists 8 sub-processors: Supabase (database and authentication, Sydney), OpenRouter (AI model routing, sent only to US-headquartered hosts with a zero-data-retention policy, zero data retention requested on every call), Mistral AI (text extraction from uploaded PDFs), Deepgram (voice-note transcription, only when a customer has voice notes enabled, every request opted out of Deepgram's model-improvement programme), Stripe (payments, PCI DSS Level 1), Vercel (hosting), Nango (connector OAuth), and Resend (transactional email). Two more services also handle customer data and are not yet in the table below: Inngest runs background jobs and keeps the result of each job step, which for a generated report is the report file itself, and Sentry receives error reports with request bodies, cookies and recognised identifiers and secrets removed before sending, though the text of an error message itself is kept. We have not yet confirmed the region of either; both are described in the privacy policy.
| Sub-processor | Purpose | Region | Certifications |
|---|---|---|---|
| Supabase | Database and authentication, including any API key you provide, encrypted at rest | Sydney, Australia (AWS ap-southeast-2) | SOC 2 Type II (infrastructure) |
| OpenRouter | AI model routing for insights, summarisation, and document reading. Zero data retention is requested on every call, and each request goes only to US-headquartered model hosts that do not train on prompts | United States | Prompts not used for training |
| Mistral AI | Text extraction from PDF documents you upload to be read, via OpenRouter, so the AI can read the figures in them. This step is not covered by the zero-data-retention request that applies to model calls | Not yet confirmed (Mistral AI is based in France) | Not applicable |
| Deepgram | Voice-note transcription, only when a customer has voice notes enabled; every request opted out of Deepgram's model-improvement programme, so audio is kept only for as long as it takes to process it | United States | Not applicable |
| Stripe | Payment processing and billing. Card details never touch Nuromi | United States (global processing network) | PCI DSS Level 1 |
| Vercel | Application hosting and edge delivery | Sydney edge (Australian customers) | Not applicable |
| Nango | OAuth connection management for connected accounting, payroll, and other systems | United States | Not applicable |
| Resend | Transactional email: sign-in links, invites, and receipts | United States | Not applicable |
Customers can request advance notification of changes to our sub-processors by emailing support@nuromi.ai. For how these vendors fit into our overall posture, see the Trust Centre and the privacy policy.