Is Nemo Router SOC 2 certified?

Not yet — and we will not claim otherwise. Nemo Router implements SOC 2-aligned controls today: encryption, access control, audit logging, change management, and tenant isolation, enforced continuously by tests and Row-Level Security rather than periodic audit cycles. Our underlying infrastructure (Google Cloud Run, Supabase) is independently SOC 2 Type II certified. A formal NemoRouter-level SOC 2 Type II audit is on our roadmap; until it completes, Enterprise customers who need a formal report can request a controls walkthrough or a completed vendor questionnaire from security@nemorouter.ai.

How do I get a DPA, SCCs, or your subprocessor list?

The DPA, SCCs, AUP, and subprocessor list are published and linked directly from this page — no gate, no sales call. A pre-signed copy of the DPA is available within one business day if your procurement process needs an executed document.

Can you complete our security questionnaire?

Yes. Email your CAIQ, SIG, or a custom questionnaire to security@nemorouter.ai. We complete it manually and return it within one business day. We do not use an automated questionnaire portal — every answer is reviewed by the engineering team that owns the control.

Where is customer data stored, and can I pin a region?

Customer data lives in managed Postgres (Supabase) with at-rest encryption, replicated within a single region. We default to US (Cloud Run us-central1). EU residency (europe-west4) is available for residency-sensitive workloads on Enterprise — EU traffic never crosses the Atlantic, and subprocessors are signed under EU SCCs.

What happens if a virtual key leaks?

Virtual keys are tenant-scoped, rate-limited, budget-capped, and observable. Revocation is immediate from the dashboard or API, and cache invalidation propagates within seconds. Keys are hashed in the database — the plaintext is shown exactly once. The blast radius of a leak is the budget on that single key, not your account.

How do I report a security vulnerability?

Email security@nemorouter.ai with details. We acknowledge within 48 hours, target 7 days for critical fixes, and follow coordinated disclosure — crediting reporters in our changelog when permitted.

Is Nemo Router SOC 2 certified?

Not yet — and we will not claim otherwise. Nemo Router implements SOC 2-aligned controls today: encryption, access control, audit logging, change management, and tenant isolation, enforced continuously by tests and Row-Level Security rather than periodic audit cycles. Our underlying infrastructure (Google Cloud Run, Supabase) is independently SOC 2 Type II certified. A formal NemoRouter-level SOC 2 Type II audit is on our roadmap; until it completes, Enterprise customers who need a formal report can request a controls walkthrough or a completed vendor questionnaire from security@nemorouter.ai.

How do I get a DPA, SCCs, or your subprocessor list?

The DPA, SCCs, AUP, and subprocessor list are published and linked directly from this page — no gate, no sales call. A pre-signed copy of the DPA is available within one business day if your procurement process needs an executed document.

Can you complete our security questionnaire?

Yes. Email your CAIQ, SIG, or a custom questionnaire to security@nemorouter.ai. We complete it manually and return it within one business day. We do not use an automated questionnaire portal — every answer is reviewed by the engineering team that owns the control.

Where is customer data stored, and can I pin a region?

Customer data lives in managed Postgres (Supabase) with at-rest encryption, replicated within a single region. We default to US (Cloud Run us-central1). EU residency (europe-west4) is available for residency-sensitive workloads on Enterprise — EU traffic never crosses the Atlantic, and subprocessors are signed under EU SCCs.

What happens if a virtual key leaks?

Virtual keys are tenant-scoped, rate-limited, budget-capped, and observable. Revocation is immediate from the dashboard or API, and cache invalidation propagates within seconds. Keys are hashed in the database — the plaintext is shown exactly once. The blast radius of a leak is the budget on that single key, not your account.

How do I report a security vulnerability?

Email security@nemorouter.ai with details. We acknowledge within 48 hours, target 7 days for critical fixes, and follow coordinated disclosure — crediting reporters in our changelog when permitted.

Trust Center

The trust center your procurement team will ask for

Security posture, compliance status, data protection, and every legal document — in one place. We are honest about what is available today and what is still in progress. No vendor-questionnaire roulette.

Request a security review Browse documents

trust · posture · contract

Current trust posture

RLS-protected tables22 / 22

USING (true) policies0

Master-key surfaceisolated

SOC 2 (NemoRouter-level)in progress

DPA / SCCs / AUPpublished

Questionnaire turnaround1 business day

TLS 1.3AES-256GDPRHIPAA-eligible

RLS-protected tables: 22 / 22
Uptime SLA: 99.9%
Doc turnaround: 1 day
Customer LLM auth: 0 master

The controls security teams audit for — and where each one stands

SOC 2-alignedControls active
GDPRCompliant
HIPAABAA eligible
ISO 27001-alignedControls active
Postgres RLSEnforced
CSP + HSTSEnforced

Security posture

How we keep prompts, keys, and spend safe

The six guarantees every Nemo Router customer gets from day one — not features behind an Enterprise tier, but invariants enforced by tests that block merges.

Encryption everywhere

TLS 1.2+ on every public endpoint with HSTS preloaded. AES-256 for data at rest across Postgres, Redis, and object storage. Virtual keys are SHA-256 hashed — the plaintext is shown exactly once.

Tenant isolation by default

Row-Level Security on all 22 Nemo tables. Cross-tenant reads are impossible at the database layer — not discouraged, denied. No "USING (true)" policies anywhere in the schema.

Virtual keys, never the master

Customer LLM traffic only ever authenticates with virtual keys (sk-nemo-…) — rate-limited, budget-capped, revocable. Master keys are reserved for internal management CRUD.

Hardened request path

Every request flows Frontend → Nemo Backend → in-process router. Auth, RLS scope, credit reserve+settle, and guardrails all run on the same hop. There is no shortcut path to a provider.

Audit-grade observability

Every administrative action, key change, and budget event is logged with the actor, source IP, payload diff, and timestamp. Exportable as CSV or JSON for SIEM ingestion.

Guardrails on every request

PII redaction, prompt-injection detection, secret scanning, abuse blocking, and response scanning run on every prompt and completion — included on every plan, never gated.

For the full architecture — request flow, RLS deep-dive, and the reserve+settle credit model — read the security page.

Compliance status

Honest about what we hold — and what we don't yet

We will never put a certification badge on a framework we have not earned. Here is exactly where each one stands.

In progress

SOC 2 Type II

NemoRouter operates SOC 2-aligned security, availability, and confidentiality controls today — encryption, access control, change management, audit logging, tenant isolation. A formal SOC 2 Type II observation period is underway; the audited report is targeted for Q3 2026. Our infrastructure substrate (Google Cloud Run, Supabase) is already SOC 2 Type II certified.

In progress

ISO/IEC 27001

Information security management practices aligned to ISO/IEC 27001 Annex A controls — asset management, access control, cryptography, operations security, supplier relationships. A formal ISO 27001 certification is on the roadmap; the infrastructure substrate (Cloud Run, Supabase) is independently ISO 27001 certified.

Controls active

GDPR

Compliant with the EU General Data Protection Regulation. Data Processing Addendum available for signature, EU Standard Contractual Clauses with subprocessors, data-subject access and erasure tooling built into the dashboard, and EU data residency available on Enterprise.

Available on request

HIPAA

NemoRouter supports HIPAA-eligible workloads. A Business Associate Agreement (BAA) is available for healthcare customers processing protected health information — request one through the Enterprise team. PII redaction guardrails run on every request at no extra cost.

Available on request

PCI DSS

NemoRouter never touches raw cardholder data. All payments are processed by Stripe, a PCI DSS Level 1 certified service provider; card numbers are tokenized client-side and never reach our servers or database. Your PCI scope for using NemoRouter is therefore minimal.

Controls active

Data residency

Pin where customer data is processed and stored. US is the default footprint; EU residency is generally available on Enterprise, with UK, Canada, Australia, Singapore, and India available on request for residency-sensitive workloads.

On the record

A formal NemoRouter-level SOC 2 Type II audit is in progress — it is not complete, and we do not market a certificate we have not earned. The infrastructure we run on (Google Cloud Run, Supabase) is independently SOC 2 Type II and ISO 27001 certified today. Until our own audit closes, request a controls walkthrough or a completed questionnaire and we will deliver it within one business day.

Data protection

The control catalog, measure by measure

The table auditors ask to see. No marketing fluff between the rows.

Measure	Implementation
Encryption in transit	TLS 1.2+, HSTS preloaded on the apex domain
Encryption at rest	AES-256 across Postgres, Redis, and object storage
Database isolation	Row-Level Security on every Nemo table (22 / 22)
API key storage	SHA-256 hashed; plaintext shown once at creation
Authentication	JWT via Supabase Auth with service-role isolation
Credit safety	Reserve + settle under Postgres advisory locks
Data retention policy	Per-org: zero / metadata / full / PII-redacted
Request log retention	90 days, auto-purged daily; longer on Enterprise
Financial records	7 years, retained for legal obligation
PII handling	Microsoft Presidio redaction guardrail, on by default

Data residency

Pin where your data lives

Customer data is replicated within a single region. We default to US; EU residency is available on Enterprise for residency-sensitive workloads.

United States (us-central1)