Security & Sub-processors
This page describes where your nervespan data lives, who processes it on our behalf, and the safeguards we apply. If anything here is unclear, contact us at [email protected].
Where your data is stored
Your workspace data — components, technologies, risks, initiatives, decisions, metrics, and related content — is stored in a PostgreSQL database hosted in the European Union (Supabase, running on AWS eu-west-1 in Ireland), managed for us by Supabase.
Tenant isolation between organisations is enforced at the database layer using PostgreSQL row-level security (RLS) policies. These policies are exercised by an automated test suite (including tenant-isolation and RLS-recursion tests run with authenticated clients) on every change to the codebase.
AI processing
When you use nervespan's AI features, inference runs on Scaleway, a French cloud provider with data centres in Paris and Amsterdam. AI processing stays on European infrastructure operated by a French company, with no US parent company behind the inference layer.
AI processing is carried out under Scaleway's terms for its Generative APIs and the Scaleway Data Processing Agreement. We do not use your prompts or outputs to train our own models. The handling, retention, and non-training of prompt data at the inference layer is governed by Scaleway's contractual terms.
Sub-processors
We use the following third-party sub-processors to operate nervespan. Each processes data only for the purpose described, under a Data Processing Agreement.
| Sub-processor | Purpose | Data region | Entity location |
|---|---|---|---|
| Supabase | Primary database, authentication, edge functions | EU — AWS eu-west-1 (Ireland) | United States |
| Cloudflare | Static site & app hosting, CDN, bot protection (Turnstile) | Global edge network | United States |
| Scaleway | AI inference (Generative APIs) and transactional email for authentication (sign-in, confirmation, recovery) | France / Netherlands | France |
| Polar | Billing & subscription management (payment details handled by Polar; not stored by nervespan) | Per Polar's infrastructure | United States |
| Resend | Transactional email for waitlist / register-interest notifications | United States | United States |
International transfers & US-incorporated vendors
Some of our sub-processors are US-incorporated companies, even where the data itself is stored on EU infrastructure. We address this openly rather than around it:
- Primary workspace data is stored in the EU (AWS eu-west-1, Ireland), and AI inference and authentication email run on Scaleway, a French provider on EU infrastructure.
- Where a sub-processor's parent company is US-incorporated (Supabase, Cloudflare, Polar, Resend), processing is governed by that provider's Data Processing Agreement, which incorporates the transfer safeguards required under UK/EU GDPR — the EU–US Data Privacy Framework where the provider is certified, with Standard Contractual Clauses and the UK International Data Transfer Addendum as the fallback mechanism. As a UK company (England & Wales), the UK IDTA applies to UK-protected data.
- Access to production data is restricted to authorised personnel who require it to operate and support the service, and administrative access is authenticated and logged.
Data export & no lock-in
You can export your full dataset at any time in portable formats (PDF, PPTX, OPML). Your data is not held hostage to your continued subscription.
Reporting a security issue
If you believe you've found a security vulnerability, please report it to [email protected]. We ask that you give us a reasonable opportunity to investigate and remediate before any public disclosure, and we will not pursue action against good-faith researchers who follow responsible-disclosure practices.