Security,
in specifics.
No badges and no certification logos we did not earn. A plain description of where your files live, who can reach them, how long we keep them, and which parts of Nemi are built so they never reach us at all.
Stored in AmsterdamRun in the NetherlandsNo third-party trackers
How your files are protected. Eight decisions you can test.
Wherever it can, the work happens on your own device. Where it cannot, it happens on machines we run, in the Netherlands.
Encrypted in transit
Every request runs over TLS/HTTPS, from the upload in your browser to the download on the other side.
Encrypted at rest
Files are encrypted with AES-256 by our storage provider in Amsterdam. What you write, from documents and form answers to chat and Nemi AI conversations, is encrypted again before it reaches our database, so a copy of it is unreadable. Our servers can still read your content to save, search and preview it; only a Vault is closed to us.
Stored in the EU
File storage runs in Amsterdam, email delivery in Frankfurt. Our own servers run in the Netherlands.
Processed on our own machines
Conversion, compression and malware scanning run on infrastructure we operate. Your files are not shipped to an external conversion or scanning company.
Malware scanning
Uploads are scanned automatically, except very large files (above 500 MB) and anything in a Vault folder, which we cannot read. Files identified as malicious are blocked before a recipient can reach them, and a human reviews it if you think we got it wrong.
Controls on every link
Password protection, expiry dates and download limits on share links, plus optional password encryption of exported .nemi documents. Guessing a link password or a sign-in code is rate limited, well above anything ordinary use needs.
Least privilege access
Administrative access is limited to what is needed to run and support the Service, and everyone with access is bound by confidentiality.
Share statistics, not tracking
An open or a download records a timestamp and a salted, truncated hash of the viewer's IP address. The raw address is never stored, and no browser or device details are, unless you switch on Trace for that one link.
Your files are yours. Five things we will not do with them.
- 01We do not train AI models on your files, documents or form responses.
- 02We do not sell your data, and we do not show advertising.
- 03We do not read or profile the contents of your files. The one index we hold, the one behind photo search, is worked out on your own device.
- 04We do not load third-party analytics or advertising scripts, and web fonts come from our own servers.
- 05We do not send your files to an AI provider on our own initiative. Nemi AI sends only what you ask it to, and an assistant of your own reaches your workspace only if you connect one.
Who else touches your data. All of them.
These are every provider that touches data on our behalf. If we add or replace one, we announce it on our Data Processing Agreement page and, where we have your email address, email you at least 30 days before the change takes effect, and you can object.
| Provider | What it does | Where |
|---|---|---|
| Wasabi | File and document storage, AES-256 at rest | EU, Amsterdam |
| AWS SES | Email delivery | EU, Frankfurt |
| Stripe | Subscription payments | EU/US, Data Privacy Framework and SCCs |
| Sign-in with Google, and calendar sync if you connect it | EU/US, Data Privacy Framework and SCCs | |
| OpenRouter | Passes a Nemi AI or AI form request on to the model, through its EU gateway, only when they are used | EU gateway, US company, Standard Contractual Clauses |
| Google Vertex AI | Runs the Nemi AI language model, without keeping what it is sent | EU region, US company, Data Privacy Framework and SCCs |
| Microsoft Azure | The backup for the Nemi AI language model, only when Google cannot take a request, without keeping what it is sent | EU data zone |
| Linkup | Web searches for Nemi AI, in Nemi and in an app you connected, only when the model decides to search, and only the search words | French company, no EU-only commitment |
| Soniox | Live captions in a meeting, only when the host turns them on, and dictation, only while you dictate | EU region |
| Apple | Apple Push Notification service: delivers notifications to the Nemi iPhone apps, if you allow them, including their title and text | EU/US, Data Privacy Framework and SCCs |
| Let's Encrypt | The certificate for a custom domain, and only the hostname | US |
| GuusLab | Application servers, conversion, compression, malware scanning, database backups | Netherlands, our own hardware |
Wasabi, where your files live, is ISO 27001 certified and its data centers are SOC 2 audited, and it encrypts every object at rest with AES-256. Those are their certifications, not ours: the section further down says exactly what we do and do not hold.
The formal version, with the notice period and your right to object, is Annex 3 of our Data Processing Agreement, and section 6.1 of the Privacy Policy describes each one in full.
Deleted means deleted. One copy, no quiet restore.
We back up the database, so your account, workspaces and documents survive a failure. We do not back up uploaded files: storage holds one copy. Nobody can quietly restore a file after you remove it, not even us. The other side of that deal is that Nemi is not your backup either, so keep your own copy of anything you cannot lose. Documents and spreadsheets do have version history inside the app, which is a different thing.
Free plan files
30 days
Removed automatically 30 days after upload, or 30 days after a paid plan ended, whichever is later.
Paid plan files
While active
Kept while your subscription is active. After a downgrade the free plan rule applies, counted from the day the plan ended, so everything already stored has a full 30 days.
Your account
Immediately
Delete it yourself in settings. Files go immediately and permanently; residual account data in database backups is gone within 30 days.
Share analytics
With the share
Live as long as the share does, and are deleted together with it.
Server logs
90 days at most
Cleared on every deploy, usually at least once a day, and never longer than 90 days.
Billing records
7 years
Seven years, because Dutch tax law says so.
What we have, and what we do not.
What you get
- A Data Processing Agreement under Article 28, applied automatically to business use
- A published sub-processor list, with 30 days notice of a change
- Breach notice to you within 48 hours for data we process for you
- Breach notice to the Dutch authority within 72 hours
- Audit rights, and deletion when you leave
What we do not hold
- SOC 2 audit
- ISO 27001 certification
- HIPAA, the Dutch Wgbo or NEN 7510
- Business associate agreements
- Permission for special category data under Article 9
Nemi is built and run in the Netherlands under the GDPR. You get a Data Processing Agreement under Article 28 that applies automatically to business use, with a published sub-processor list, breach notification within 48 hours, audit rights and deletion when you leave. Our Privacy Policy covers your own rights of access, correction, export and erasure, and support@nemilab.com is also our point of contact under the EU Digital Services Act.
We are not SOC 2 audited, not ISO 27001 certified, and not built for HIPAA, the Dutch Wgbo or NEN 7510. We do not sign business associate agreements. Because of that, Nemi may not be used for special categories of personal data under Article 9 GDPR, such as health data or biometrics, or for patient records. That rule is in Section 7 of our Terms of Service, and it applies to the questions you ask in a Nemi form too.
If a data breach puts your rights at risk, we notify the Dutch supervisory authority within 72 hours and affected users without undue delay. For data we process on your behalf as a processor, you hear from us within 48 hours.
Found a problem? Tell us.
security@nemilab.com- First reply
- 2 business days
- Credit
- If you want it
- Paid bounty
- No
Report a vulnerability to security@nemilab.com. Include the steps to reproduce it and what you think the impact is. You get a reply within two business days, we keep you posted while we fix it, and we credit you if you want.
Please test only against your own account, do not access other people's data, and give us a reasonable window to fix things before publishing. We will not pursue researchers who follow that. We do not run a paid bug bounty.
Illegal content or abuse goes to support@nemilab.com, our single point of contact under Section 8 of our Terms of Service. Mail to abuse@nemilab.com reaches us too.
Read the DPAPrivate because of how it is built.
15 GB free, stored in the EU, never trained on. Nemi is opening in groups: put your name down and we tell you when yours is up.
15 GB free when you are in. No card.