Trust & billing
Encryption, access controls, approvals, compliance status and how to report a vulnerability.
How Nurvia protects your information, what's in place today and what's still in progress. This is a summary; the Trust Center on nurvia.app links to the full commitments.
Encryption
| What | How it's protected |
|---|---|
| Data in transit | Connections carrying your content use authenticated encryption — TLS 1.2 or later. |
| Data at rest | AES-256 for databases, documents, replicas and backups. |
| Credentials | Access tokens, refresh tokens and session secrets are encrypted or held in secrets management, and limited to the services that need them. |
Access
- Privileged production access needs multi-factor authentication and an authorized purpose, is logged, and is reviewed at least quarterly.
- Support needs permission. Reading private content to help with a support request needs specific permission. Security investigations and legally required access are separately justified, limited and recorded.
- Workspaces stay separate. Workspace permissions apply to reads, searches, exports, attachments, saved memories and AI retrieval. Being in an organization's workspace doesn't give it access to your Personal workspace.
- Inside a workspace, roles and permissions decide who sees guest lists, money, documents and door codes.
Protect your account
Turn on two-step sign-in
Add Nurvia to an authenticator app and save your recovery codes. See Account and sign-in.
Check your devices
Sign out of sessions you don't recognise in SettingsProfile and sign-inDevices.
Review connected accounts
Disconnect anything you no longer use in Connections. Disconnecting stops new tasks through that account and starts revoking access.
Approvals are a security control
Every action is checked against your current permissions: account, workspace, resource, action type, recipient, duration and limits. Purchases, paid bookings, cancellations with a penalty, sensitive disclosures and destructive changes need your specific approval, or a standing rule detailed enough to cover them.
Instructions hidden in emails, documents, web pages or tool responses never count as your authority. See How Nuri stays safe.
Compliance
| Program | Status |
|---|---|
| SOC 2 Type II | In progress — preparing |
| ISO/IEC 27001 | In progress — working toward certification |
| GDPR and UK GDPR | In progress — implementing an operational privacy program |
| Google verification and CASA | In progress |
| Independent application and agent testing | In progress — establishing |
| SOC 1, PCI DSS | Planned, where a service or payment data requires it |
Is Nurvia SOC 2 certified?
Not yet. Work in progress is never presented as a completed certification or assessment. Issued reports and certificates will be shared once complete, under confidentiality terms.
Google user data
Nurvia's use and transfer to any other app of information received from Google APIs will adhere to the
Google API Services User Data Policy, including the
Limited Use requirements. Google user data is never used for ads, never sold, and never used to develop, improve or
train generalized AI or machine-learning models. Sign in with Google uses only your basic profile (openid,
email, profile) and doesn't give Nurvia access to your Gmail, Calendar or Drive.
Subprocessors
Nurvia uses providers for hosting, storage, authentication, AI processing, communications, payments, support and security. They're bound by data-protection and confidentiality terms, including the no-training rule. Customers receive the current list before processing starts, get 30 days' notice of a planned addition or replacement, and have 15 days to object on reasonable data-protection grounds. Ask at privacy@nurvia.app.
For a security review, email legal@nurvia.app.
Report a vulnerability
Email us
Write to support@nurvia.app with the subject Security report and a short description of the issue. Don't include live passwords, tokens, payment information or other people's private content.
We confirm a secure channel
If sensitive details are needed, we'll give you an appropriate channel to send them.
We investigate and keep you updated
Please allow time to fix the issue before publishing anything that could expose users.
Get written authorization before any active testing. Nurvia won't pursue legal action solely for good-faith research done within a written authorization and its conditions. Never access, keep or publish other people's data, and don't run denial-of-service, phishing or social-engineering tests.
