# Security and Data Protection Source: https://nerix.ai/security Security # Security and data protection, in plain language. This page is written to be sent to your data protection officer. Every claim on it can be checked in the product. - 01 Your data is stored in the European Union: servers in France, with files and backups in the Netherlands. - 02 We never train a model on your documents. - 03 The audit log is append-only. Not even an owner can edit or delete an entry. - 04 Delete a workspace and it is erased for good after a 30-day grace period. 01 Data region ## Where your data lives. There is one region today, the European Union: nerix.ai runs on OVHcloud servers in Gravelines, France, and keeps encrypted files and backups with Backblaze in Amsterdam, the Netherlands. United Kingdom and United States capacity is not live yet, and this page will say so on the day it is. Every workspace's documents, search index, conversations and logs are stored there. Where AI work is processed follows your workspace's provider choice: a new workspace sends it only to providers in the EU and to the models on our own server. - European Union Servers in Gravelines, France. Files and backups in Amsterdam, the Netherlands Live - United Kingdom Not available yet Coming soon - United States Not available yet Coming soon **Fig. 1** Regions and their status today. 02 Your content ## What happens to your content. - 01 ### Training stance We never use your documents to train a model. Mistral, the EU provider every workspace starts with, does not train on them either. Before you switch on any other provider, the product shows what that provider may do with what it receives. - 02 ### Names and numbers hidden Before text leaves our server for an AI provider, email addresses, phone numbers, bank and card numbers and ID numbers are replaced with codes, and so are the names of the people, clients and suppliers your workspace knows. The answer comes back with the real values put back in. A name nobody has listed can still pass, so treat it as less exposure, not a guarantee. - 03 ### Retention, export and deletion Set how long documents and conversations are kept, and older ones are deleted, files included, unless a legal hold applies. Export the whole workspace at any time, free, in open formats. A deleted workspace is erased for good after a 30-day grace period. When a person's account is erased, the audit log keeps the event but replaces their name and email with a code. - 04 ### Audit log Entries cannot be edited or deleted, including by an owner, and an owner can download them. They are kept for the life of the workspace. Sign-ins, member changes, uploads, deletions, exports, settings and every chat turn are written to it, not only administrative changes. - 05 ### Access control Roles you build switch by switch, starting from owner, admin, member and viewer, with a preview of what each role sees. Folder and document access screens decide who can open what. Guests for people from outside. Two-step sign-in with an authenticator app. - 06 Coming soon ### Single sign-on Single sign-on over SAML or OIDC and SCIM directory sync are coming soon. - 07 Early access ### API keys Keys for the API at api.nerix.ai, the Node SDK and the command line. Each key has only the scopes you give it, and is stored as a prefix and a hash, so it cannot be read back. 03 Providers ## Which AI providers see your content, and where. Your organisation chooses which AI providers may process its content. A new workspace allows only providers in the EU and our own server. The picker prints each provider's cautions at the same weight as its strengths. DeepSeek's own API processes data in China. We print this caution on the picker. If that is not acceptable for your content, do not allow DeepSeek. Provider Where it processes Status Mistral France, in the EU Default nerix server Gravelines, France (search and ranking) Default Anthropic United States When you allow it Google Worldwide When you allow it DeepSeek China, first-party API Caution Soniox, Cartesia, ElevenLabs Worldwide Speech, when you allow it **Fig. 2** Where each provider processes content. Status as of today. 04 The rest ## Sub-processors, encryption, application security, certifications. - 01 ### Sub-processors The AI providers above process content only for the work you route to them, and only once your organisation allows them. Hosting is OVHcloud in Gravelines, France, encrypted files and backups are with Backblaze in Amsterdam, the Netherlands, and card payments go through Stripe. The sub-processor list names every company, what it does and where, and owners hear of a new one 30 days before. [See the sub-processor list](https://nerix.ai/legal/subprocessors) - 02 ### Incidents A breach register and a written runbook. If an incident touches your workspace, owners are told within 24 hours in the product and by email, and the supervisory authority within 72 hours where we are the controller. - 03 ### Encryption Every connection uses TLS. Provider keys and connector tokens are stored encrypted. Files you upload are kept encrypted in nerix's private central storage service, and are opened only through short-lived links for people who are allowed to see them. - 04 ### Application security A strict Content-Security-Policy with a fresh nonce on every request is live on every page. There are no third-party scripts, fonts, advertising trackers or CDNs anywhere on nerix.ai, and everything is self-hosted; the one optional script, our own visit counter, loads only after a visitor says yes. A shared conversation shows the answers, not the documents behind them, unless the reader already has access to those documents. - 05 ### Your rights Every person can download their own data and erase their account in Settings, Data and legal. Organisations accept our data processing agreement in the app. We answer other requests within one month. - 06 ### Certifications nerix.ai does not yet hold SOC 2 or ISO 27001, and we will not claim them. What we can show you today: the append-only audit log, the no-training stance, storage in the EU, erasure, and this page. When a certification lands, it will be listed here with its scope. ## For DPOs and security teams. Send questionnaires and sub-processor requests to a person. info@nerix.ai Or write from the contact page ## Keep reading - AI, data and websites AI [AI, data and websites](https://nerix.ai/blog/category/ai-data-and-websites) November 1, 2026 5 min read ### [AI assistants with memory compared](https://nerix.ai/blog/ai-assistants-with-memory-compared) An AI assistant with memory remembers your role and preferences between chats. How ChatGPT, Claude, Gemini and nerix handle memory, and the controls to check. Read the guide - Quality and audits GDPR [Quality and audits](https://nerix.ai/blog/category/quality-and-audits) November 1, 2026 7 min read ### [GDPR checklist for small businesses](https://nerix.ai/blog/gdpr-checklist-for-small-businesses) A GDPR checklist for small businesses, article by article. Lawful basis, privacy notice, processors, security, 72 hour breach reports and data subject requests. Read the guide - Quality and audits nis2 [Quality and audits](https://nerix.ai/blog/category/quality-and-audits) November 1, 2026 7 min read ### [NIS2 checklist for small companies](https://nerix.ai/blog/nis2-checklist-for-small-companies) A NIS2 checklist for small companies. See if the directive applies, the ten Article 21 security measures and the 24 hour, 72 hour and one month deadlines. Read the guide