Security and AI Data Handling Addendum

1. Scope

This Security and AI Data Handling Addendum (the “Addendum”) forms part of an agreement that expressly incorporates it. It applies to Customer Content and personal information processed within the Services covered by that agreement.

2. Security governance

Nurvia will maintain a documented information-security program with assigned responsibility for risk management, access administration, incident response, service-provider oversight, and policy review.

3. Encryption and credentials

Information in transit. Nurvia-controlled connections carrying Customer Content will use authenticated encryption in transit, with TLS 1.2 or later where TLS is used. Sensitive information will not be routed through an insecure alternative without an appropriate, expressly authorized safeguard.

4. Authorized processing and data minimization

Nurvia will validate account, workspace, resource, and task permissions before accessing Customer Content. Information selected for AI processing will be limited to what is reasonably necessary for the authorized feature.

5. AI data-use restrictions

Nurvia will not use Customer Content to train, fine-tune, distill, or improve the learned parameters of AI or machine-learning models. It will impose the same restriction on service providers processing that content on its behalf.

6. Nuri and Autoflow authorization

Actions will be validated against the user’s current permissions before execution. Controls will check the relevant account, workspace, resource, action type, recipient, duration, and any spending or other limit.

7. Access management and workspace separation

Personnel access will follow least privilege and individual accountability. Privileged production access will require strong authentication, including multi-factor authentication, an authorized purpose, and appropriate logging. Privileged access will be reviewed at least quarterly.

8. Secure development and application testing

Nurvia will maintain a secure development process that includes review of material changes, protection of source code and secrets, dependency assessment, and security testing proportionate to the risk.

9. Retention, logging, and deletion

Routine logs will be limited to information needed for operation, security, and accountability. Private message bodies, full documents, detailed itineraries, and authentication secrets will be excluded from ordinary analytics and routine technical logs.

10. Incident response and continuity

Nurvia will maintain procedures for incident assessment, containment, evidence preservation, remediation, communication, and post-incident review. Personal Data Breach notifications will follow the applicable DPA and mandatory law.

11. Assurance and regulatory scope

Nurvia is currently working toward a SOC 2 Type II examination and ISO/IEC 27001 certification. Nurvia is also implementing an operational GDPR and UK GDPR privacy program, progressing applicable Google verification and CASA requirements, and establishing independent testing of application and agent controls.

12. Security information and changes

Customers and prospective customers may request relevant security documentation, Subprocessor information, processing-location details, and information about applicable assessments. Sensitive materials may be provided under reasonable confidentiality terms.

Related

• Legal Nurvia’s agreements and policies: terms, privacy, data processing, security, retention, cookies, messaging, acceptable use, and vulnerability disclosure.
• Terms of Service The terms governing Nurvia, Nuri, Autoflow, accounts, subscriptions, and authorized actions.
• Privacy Policy How Nurvia collects, uses, protects, and shares personal information, and the choices available to you.
• Cookie Notice How cookies and similar technologies are used, and how to manage your choices.
• Acceptable Use Policy Requirements for lawful, authorized, and responsible use of the Services.
• Trust & Security Privacy, security, and AI data handling at Nurvia: no model training on your content, permission-based actions, and clear retention.