Data Processing Agreement (DPA)

1. Roles and Scope

Under this agreement, the Client is the Data Controller, and Nom AI acts exclusively as the Data Processor. Nom AI processes Personal Data solely on the documented instructions of the Controller via API calls.

2. Data Breach Notification

Nom AI maintains a 24/7/365 Security Operations Center (SOC) leveraging Amazon GuardDuty. In the event of a confirmed Personal Data Breach, Nom AI will notify the Controller without undue delay, and in no event later than 48 hours after becoming aware of the breach, providing all necessary forensics to assist the Controller with regulatory reporting.

3. Audits and Inspections

Nom AI undergoes annual third-party audits (SOC 2 Type II). A copy of the auditor's report will be provided to enterprise clients under NDA. Physical onsite audits of AWS data centers are prohibited per AWS security policies, but logic/architecture audits are permitted with 30 days notice.