Security

Powerful, and on a leash.

Nomi can do a lot. It only does what you allow — and every external action waits for a human.

Data protection

  • AES-256 encryption at rest, TLS 1.3 in transit
  • Your data is never used to train models
  • EU or US data residency on Enterprise
  • Delete on request, completed within 30 days (immediately for memory)

Control

  • Three permission tiers: read, internal, external
  • External actions always require approval
  • Admin policies cap what Nomi can do org-wide
  • Full activity log for every action

Compliance

  • SOC 2 Type II audit in progress (target Q1 2027)
  • GDPR and CCPA aligned, DPA available
  • Annual third-party penetration testing
  • Responsible disclosure: security@nomi.app