Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.nusomi.com/llms.txt

Use this file to discover all available pages before exploring further.

​
Standards

StandardStatusReport
SOC 2 Type IIAnnual audit. Latest report covers the trailing 12 months.Available under NDA.
ISO 27001Certified.Certificate available on request.
ISO 27701 (privacy)Certified.Certificate available on request.
GDPRDPA available. EU data residency on the eu-west-1 deployment.DPA on request.
HIPAABAA available on enterprise tier.BAA on request.
PCI DSSWe do not process cardholder data; masking patterns prevent capture of PAN-shaped strings.N/A.
FedRAMP ModerateIn progress.Status update on request.

​
Control mapping (selected)

The full controls matrix lives in the SOC 2 report. A subset, mapped to where the control surfaces in the product:
Control areaHow it’s enforced
Logical accessSSO / SAML / OIDC. Workspace roles. API key scopes. JIT replay tokens.
Encryption in transitTLS 1.3, mTLS optional self-hosted.
Encryption at restAES-256 + customer-managed keys (BYOK) on enterprise.
Network segmentationPer-tenant VPC subnets (SaaS) / customer VPC (self-hosted).
Vulnerability managementQuarterly internal scans, annual external pen test, bug bounty.
Change managementAll deploys peer-reviewed, signed images, CI-enforced.
Audit loggingEvery access logged. SIEM export. 18-month retention default.
Incident response24×7 on-call. 4-hour customer notification SLO. Post-mortems published within 10 business days.
Backup & DRPostgres PITR + cross-region object replication. Quarterly DR drill.
Vendor managementSubprocessor list published; customer notification on additions.

​
Subprocessors (SaaS)

  • AWS — primary infrastructure.
  • Cloudflare — edge + DDoS protection.
  • Datadog — observability (no customer frame/event content sent).
  • Stripe — billing.
The list is published at nusomi.com/legal/subprocessors. We notify customers 30 days before adding a new subprocessor.

​
Data residency

RegionEndpoint
USapi.nusomi.com (us-east-1)
EUeu.api.nusomi.com (eu-west-1)
APACapac.api.nusomi.com (ap-south-1)
Data stays in the chosen region. Cross-region replication only within the same region’s failover zone. For self-hosted, residency is whatever your infrastructure is.

​
Retention

DataDefault retention
Frames90 days, then auto-archive to cold storage. Configurable 1–3650 days.
Events18 months. Configurable.
Memory graphIndefinite (workflow-level structure, no PII).
Audit log18 months. Configurable.
Test-mode sessions (nsk_test_…)7 days, hard delete.
Soft-deleted sessions30 days, then hard delete.
Override per workspace in the dashboard or via: 
PATCH /v1/workspaces/current

{
  "retention": {
    "frames_days": 30,
    "events_days": 180
  }
}

​
Right to erasure (GDPR / CCPA)

End-user erasure requests are filed via: 
POST /v1/privacy/erasure

{
  "subject": "alex@acme.com",
  "scope": "all"
}
The request runs through:
  1. Find every session whose actor or metadata references the subject.
  2. Hard-delete frames and events.
  3. Strip subject references from the memory graph.
  4. Log the erasure in the audit trail.
Completed within 30 days. The audit-trail entry is the only artifact retained.

​
Requesting reports

Email security@nusomi.com from a verifiable address with:
  • Your workspace ID (or “evaluating”) and the report you need.
  • Your NDA (or ask us to send our standard one).
Same-day turnaround for SOC 2 / ISO certificates. DPA / BAA executed within five business days.