Skip to content
Start free

Security

Security and data protection, in plain language.

This page is written to be sent to your data protection officer. Every claim on it can be checked in the product.

  • 01Your data is stored in the European Union: servers in France, with files and backups in the Netherlands.
  • 02We never train a model on your documents.
  • 03The audit log is append-only. Not even an owner can edit or delete an entry.
  • 04Delete a workspace and it is erased for good after a 30-day grace period.

01Data region

Where your data lives.

There is one region today, the European Union: nerix.ai runs on OVHcloud servers in Gravelines, France, and keeps encrypted files and backups with Backblaze in Amsterdam, the Netherlands. United Kingdom and United States capacity is not live yet, and this page will say so on the day it is.

Every workspace's documents, search index, conversations and logs are stored there. Where AI work is processed follows your workspace's provider choice: a new workspace sends it only to providers in the EU and to the models on our own server.

  • European UnionServers in Gravelines, France. Files and backups in Amsterdam, the NetherlandsLive
  • United KingdomNot available yetComing soon
  • United StatesNot available yetComing soon
Fig. 1 Regions and their status today.

02Your content

What happens to your content.

  • 01

    Training stance

    We never use your documents to train a model. Mistral, the EU provider every workspace starts with, does not train on them either. Before you switch on any other provider, the product shows what that provider may do with what it receives.

  • 02

    Names and numbers hidden

    Before text leaves our server for an AI provider, email addresses, phone numbers, bank and card numbers and ID numbers are replaced with codes, and so are the names of the people, clients and suppliers your workspace knows. The answer comes back with the real values put back in. A name nobody has listed can still pass, so treat it as less exposure, not a guarantee.

  • 03

    Retention, export and deletion

    Set how long documents and conversations are kept, and older ones are deleted, files included, unless a legal hold applies. Export the whole workspace at any time, free, in open formats. A deleted workspace is erased for good after a 30-day grace period. When a person's account is erased, the audit log keeps the event but replaces their name and email with a code.

  • 04

    Audit log

    Entries cannot be edited or deleted, including by an owner, and an owner can download them. They are kept for the life of the workspace. Sign-ins, member changes, uploads, deletions, exports, settings and every chat turn are written to it, not only administrative changes.

  • 05

    Access control

    Roles you build switch by switch, starting from owner, admin, member and viewer, with a preview of what each role sees. Folder and document access screens decide who can open what. Guests for people from outside. Two-step sign-in with an authenticator app.

  • 06Coming soon

    Single sign-on

    Single sign-on over SAML or OIDC and SCIM directory sync are coming soon.

  • 07Early access

    API keys

    Keys for the API at api.nerix.ai, the Node SDK and the command line. Each key has only the scopes you give it, and is stored as a prefix and a hash, so it cannot be read back.

03Providers

Which AI providers see your content, and where.

Your organisation chooses which AI providers may process its content. A new workspace allows only providers in the EU and our own server. The picker prints each provider's cautions at the same weight as its strengths.

DeepSeek's own API processes data in China. We print this caution on the picker. If that is not acceptable for your content, do not allow DeepSeek.

MistralFrance, in the EUDefault
nerix serverGravelines, France (search and ranking)Default
AnthropicUnited StatesWhen you allow it
GoogleWorldwideWhen you allow it
DeepSeekChina, first-party APICaution
Soniox, Cartesia, ElevenLabsWorldwideSpeech, when you allow it
Fig. 2 Where each provider processes content. Status as of today.

04The rest

Sub-processors, encryption, application security, certifications.

  • 01

    Sub-processors

    The AI providers above process content only for the work you route to them, and only once your organisation allows them. Hosting is OVHcloud in Gravelines, France, encrypted files and backups are with Backblaze in Amsterdam, the Netherlands, and card payments go through Stripe. The sub-processor list names every company, what it does and where, and owners hear of a new one 30 days before.

    See the sub-processor list
  • 02

    Incidents

    A breach register and a written runbook. If an incident touches your workspace, owners are told within 24 hours in the product and by email, and the supervisory authority within 72 hours where we are the controller.

  • 03

    Encryption

    Every connection uses TLS. Provider keys and connector tokens are stored encrypted. Files you upload are kept encrypted in nerix's private central storage service, and are opened only through short-lived links for people who are allowed to see them.

  • 04

    Application security

    A strict Content-Security-Policy with a fresh nonce on every request is live on every page. There are no third-party scripts, fonts, advertising trackers or CDNs anywhere on nerix.ai, and everything is self-hosted; the one optional script, our own visit counter, loads only after a visitor says yes. A shared conversation shows the answers, not the documents behind them, unless the reader already has access to those documents.

  • 05

    Your rights

    Every person can download their own data and erase their account in Settings, Data and legal. Organisations accept our data processing agreement in the app. We answer other requests within one month.

  • 06

    Certifications

    nerix.ai does not yet hold SOC 2 or ISO 27001, and we will not claim them. What we can show you today: the append-only audit log, the no-training stance, storage in the EU, erasure, and this page. When a certification lands, it will be listed here with its scope.

For DPOs and security teams.

Send questionnaires and sub-processor requests to a person.

info@nerix.aiOr write from the contact page

  • AI, data and websites5 min read

    AI assistants with memory compared

    An AI assistant with memory remembers your role and preferences between chats. How ChatGPT, Claude, Gemini and nerix handle memory, and the controls to check.

  • Quality and audits7 min read

    GDPR checklist for small businesses

    A GDPR checklist for small businesses, article by article. Lawful basis, privacy notice, processors, security, 72 hour breach reports and data subject requests.

  • Quality and audits7 min read

    NIS2 checklist for small companies

    A NIS2 checklist for small companies. See if the directive applies, the ten Article 21 security measures and the 24 hour, 72 hour and one month deadlines.