Security & Compliance Overview

01 Tenant Isolation

Each company's data is isolated from that of every other company at the database layer, through Postgres Row-Level Security:

• Row-Level Security is enforced and fail-closed: where tenant context is absent, access is denied rather than permitted.
• A boot-time posture check refuses to start production where isolation is not intact, so that the platform cannot operate in a state in which tenants could bleed into one another.
• Application-layer company scoping provides a second, redundant control atop the database-level enforcement.

02 Encryption

• At rest (field-level). Stored secrets, such as third-party API keys, and sensitive fields, such as compensation, are encrypted with AES-256-GCM, with key rotation.
• In transit. Connections use TLS with certificate validation, including database connections.

03 Access Controls

• Authentication through AWS Cognito, with separate personal and workspace user pools.
• TOTP multi-factor authentication (RFC 6238) with strict verification, together with step-up re-authentication for sensitive actions.
• Role-based access control with granular, department-scoped permissions.
• Action audit logging, database-backed, including an AI audit trail.

04 Private Artificial Intelligence

• AWS Bedrock only. All model and embedding processing operates exclusively on AWS Bedrock within Actaa's own AWS account and region — with no third-party model endpoints — using leading foundation models available through AWS Bedrock.
• No training on Customer Data. AWS Bedrock does not use your prompts or content to train its foundation models.
• Three-layer PII scrubbing. Personal and sensitive data is redacted at ingestion, before the prompt, and on the model output; HR-sensitive content is hard-blocked.
• Per-user controls and a fail-closed spend gate that blocks AI usage in the absence of an active subscription.

05 Intellectual-Property Protection

• Document IP Ledger — a hash-chained, tamper-evident proof-of-existence recorded per document, together with cross-organization copy detection capable of alerting the originator where a copy appears in another organization. This constitutes an alert-and-evidence mechanism and does not guarantee prevention.
• Data-loss prevention — per-member no-download tiers and watermarked, EXIF-stripped preview rendering for sensitive files.

06 Data-Subject Rights

Nomisma has implemented the data-subject rights most material to portability and control:

• GDPR Article 17 (erasure) — anonymized deletion, with a 30-day recovery window before data is removed from active systems.
• GDPR Article 20 (portability) — one-click export of Customer Data.

07 Artificial Intelligence and Employment Law

The AI Features are assist-only. A multi-layer defense ensures that AI assists but never autonomously makes or ranks employment decisions: it does not score or rank individuals for the purpose of determining outcomes, and a person remains the decision-maker. The Service is designed to be aligned with the principal automated-employment-decision and anti-discrimination laws, including NYC Local Law 144, California FEHA, Illinois HB 3773, and the Colorado AI Act.

08 Compliance Posture

Nomisma states its posture plainly, identifying what is implemented today and what remains on the roadmap. Nomisma does not claim certifications it does not hold.

For the contractual security commitments and the technical and organizational measures, see Annex II of the Data Processing Addendum. For the sub-processors, see Sub-processors. For the handling of personal data, see the Platform Privacy Policy.