Our approach to security starts with a different question than most vendors answer. Instead of asking “who is allowed to see this data,” we ask “does anyone need to see it at all.” For most of what Nera does, the answer is no, not even us.
This page covers what our security and privacy posture actually looks like today: what’s certified, what’s architectural, and what’s still in progress. We’d rather tell you exactly where we stand than round up.
What’s in scope, what isn’t, and what we need from you before regulated data reaches Nera.
The Nera ChatApp, the Excel add-in, and API/SDK access are covered by our BAA and DPA. A signed BAA must be in place before any protected health information is submitted to Nera, and a DPA before personal data subject to GDPR is submitted. We provide our standard BAA and DPA; email info@nera.systems to start.
Support channels, email correspondence, and any trial or sandbox environment are not covered, so please don’t send regulated data through them. Third-party tools you connect to Nera are governed by your agreement with that provider, not by ours, and you’re responsible for evaluating them.
Your side of the arrangement. Enforce SSO and multi-factor authentication for your users, keep your encryption keys under your own control, remove access promptly when people leave, and confirm that your intended use is permitted under the regulations that apply to you. Nera’s output is advisory and reviewed by a person; it should not be the system of record for regulated data, and it should not be used for automated decisions about individuals.
Most security pages describe controls: who can access what, how access is logged, how breaches are handled. Those controls matter, and we have them. But they’re not the reason Nera is different.
The reason is architectural: customer data is encrypted before it ever leaves your environment, using keys you hold. The AI model receives your question and the structure of your data, never the underlying values. Computation happens on encrypted data. Results come back encrypted and are decrypted with your key.
Neither the model provider (Anthropic, Google) nor Nera itself ever has access to your data in a readable form, at any point in the process. That’s not a policy we’ve committed to. It’s a property of how the system works.
The practical consequence: if Nera’s infrastructure were compromised, there’s nothing in it for an attacker to read. Your data was never there in a form anyone could use.
Your data is encrypted client-side, in your environment, before it’s transmitted. AES-256 at rest, TLS 1.2+ in transit.
Your data is never used to train or improve any model, Nera’s or a third party’s. This is both a contractual commitment and an architectural fact, since we can’t train on data we can’t read.
Nera works with Claude and Gemini today, with support for switching models mid-conversation. You can also supply your own model API keys.
All production data is currently hosted in United States regions, with no replication elsewhere by default.
Multi-factor authentication is enforced across all infrastructure. Production access is role-based and limited to named engineering staff.
Nera has experienced no information security breach and no non-minor security incident since founding in November 2023.
Nera is a young company, and we think the honest version of that fact serves you better than a page full of green checkmarks.
The core architectural guarantee, encryption, and the fact that customer data is never readable by Nera or by the model provider. This isn’t a roadmap item. It’s how the system has worked since day one.
Formal third-party attestation (SOC 2 Type II), independent penetration testing, and a fully documented business continuity and disaster recovery program. These are standard expectations for enterprise procurement, and we’re building toward them on a committed timeline rather than claiming them early.
We’d rather have this conversation directly with your security team than leave it to a badge to answer. If you’re evaluating Nera for a regulated use case, we’re glad to walk through our data flow design, our compliance roadmap and timeline, and answer your team’s specific questions.
Nera uses a deliberately small set of subprocessors:
| Subprocessor | Purpose | Data Involved |
|---|---|---|
| Google Cloud Platform | Cloud infrastructure, hosting | Encrypted customer content, operational metadata |
| Microsoft Azure | Cloud infrastructure (secondary), hosting | Encrypted customer content, operational metadata |
| Anthropic (Claude) | AI model provider | Query and dataset schema only, never underlying values |
| Google (Gemini) | AI model provider | Query and dataset schema only, never underlying values |
| Stripe | Payment processing | Billing and transaction data |
We’ll notify customers before adding a new subprocessor with access to their data. Full details are in our DPA.
Nera runs on Google Cloud Platform (primary) and Microsoft Azure (secondary), both of which maintain SOC 2 Type II and ISO 27001 certification at the infrastructure layer under their own published data processing addenda:
Google Cloud Data Processing Addendum
Microsoft Products and Services Data Protection Addendum
All production data is hosted in United States regions, with no replication elsewhere by default. Nera has no owned data centers or physical infrastructure; physical security is inherited from these providers’ published certifications.
The policies and agreements that govern how Nera handles your data, and the answers your security team will want first.
Answers to the questions security and compliance teams ask most about how Nera handles data.
What personal information we collect, how we use it, and the choices and rights you have.
Our commitments as a processor: security measures, subprocessors, deletion, audits, and international transfers.
The agreement governing use of the Nera platform, including data ownership and the no-training commitment.
The terms that govern browsing nera.systems, separate from the Terms of Service for the product itself.
Under NDA: system architecture and data-flow documentation, our current policy set (access control, incident response, data retention, and related policies), and our subprocessor list.
Reach out to your Nera contact, or email us directly to get your security team connected with ours. We’re glad to walk through the architecture, the compliance roadmap, and your team’s specific questions.
Contact usThis page is provided for informational purposes only and does not constitute legal or compliance advice. Please consult your own advisors about your obligations.
Last updated: August 2026