Snapshot 94025
Normalized text
Scripts and page chrome removed; this is what change detection compares.
New:Nomic Self Service Starts At $20/Month.Start for free New: Our products Nomic transforms decades of unstructured data into organized, AI-ready knowledge. Empower your teams with domain-specific agentic workflows that accelerate every project, workflow, and decision across your firm's institutional knowledge. Nomic Platform Our turnkey platform that accelerates your engineers and designers with domain-specific agentic workflows across your firm's knowledge. Agent API Access our domain-specific models for search, document understanding and drawing parsing to accelerate your firm's internal AI solutions. Use Cases See how Nomic agents review drawings against codes, check submittals, run drawing QA/QC, and search firm-wide. Ground AI in your drawings, specs, and project data to catch issues before construction and accelerate every workflow. Learn Docs, Nomic University, and live Office Hours: dedicated resources to help you learn Nomic in multiple formats and get to value fast. Docs Setup, the Nomic agent, workflows, and capabilities. Step-by-step how to use Nomic. Nomic University Recorded tutorials on getting to value with Nomic, a growing curriculum from first setup to advanced workflows. Office Hours Monthly live session. Register for the next date and watch the latest recording. Security & Compliance Purpose-built for AEC firms. Your data stays in the systems where it already lives. Last updated: June 2026 For security-related questions or to report vulnerabilities: security@nomic.ai Looking for Free or Individual terms? Go to the Individual Terms of Service. Nomic Security Posture Nomic is the AI platform purpose-built for AEC firms, accelerating how you work with your project knowledge without moving your data, weakening your permissions, or training someone else's model on your projects. Your data stays in the systems where it already lives: SharePoint, Egnyte, Autodesk Construction Cloud, Bentley. We index it for Nomic agents to use; your files are never permanently copied to Nomic infrastructure unless directly uploaded. We inherit your existing permissions. We're SOC 2 Type II certified, pen-tested annually, and broadly compliant with major regional data protection and privacy regulations. Our US State DPA covers customers in the United States; our Global DPA covers international data protection requirements. When AI is used, your content is processed under zero-data-retention agreements with Anthropic, OpenAI, and Google Cloud Vertex. They keep nothing. We retain only what's necessary to run the service (cached documents, your conversations, usage logs) and delete everything within 30 days of termination. Nomic is primarily delivered as a managed platform on AWS infrastructure that is isolated per-tenant, with regional data hosting options in Europe, the UK, the US, and Australia. Alternative deployment options are available. Contact sales to discuss. Resources: SOC 2 report & pen test (NDA) · US State DPA · Global DPA · Privacy Policy · Terms of Service · Individual Terms of Service Nomic Data Flows 01Authentication Users sign in directly or through your identity provider (SAML/OIDC via WorkOS). MFA is enforced by your IdP configuration when SSO is used. 02Permission check Nomic enforces the access controls already configured in your source systems. If a user can't see a file in SharePoint, they can't see it in Nomic. 03Retrieval Relevant context is pulled from the indexed corpus the user is authorized to see. 04Inference Context and prompt are sent over TLS 1.2+ to Anthropic, OpenAI, or Google Cloud Vertex. All three operate under executed zero-data-retention agreements; content is discarded after the response is generated. 05Response The answer is returned to the user with citations to source documents. The interaction is logged in the audit log available to your admins. AI inference is the only point where customer content leaves Nomic infrastructure, and it is governed by ZDR end-to-end at that boundary. Data Hosting & Residency Nomic now supports customer data hosting and residency in the following AWS regions for Nomic-managed deployments. During onboarding, customers can select the region that best matches their regulatory, procurement, and operational requirements. Europe AWS eu-central-1 Frankfurt Australia AWS ap-southeast-2 Sydney United States AWS us-west-2 Oregon United Kingdom AWS eu-west-2 London These residency options apply to customer data hosted by Nomic, including files stored in Nomic-managed infrastructure, indexes, cached documents, conversations, usage logs, and audit data. AI inference subprocessors continue to be governed by the zero-data-retention and subprocessor controls described on this page. Data Retention There are two retention layers, and they work differently. We've found it helps to call them out separately. What Nomic retains (as your data processor) User-generated content: conversations, reports, annotations, and indexes retained for the duration of the subscription unless you delete them Usage metadata: session logs, query timestamps, and user activity retained for audit and platform operations What our AI inference subprocessors retain Nothing. Anthropic, OpenAI, and Google Cloud Vertex AI operate under executed zero-data-retention agreements. Documents are processed ephemerally for inference and discarded. Your data is never used to train their models. On termination: All customer data is deleted within 30 days using secure erasure methods. Certification of deletion available on request. See also: US State DPA · Global DPA · Terms of Service · Individual Terms of Service Permissions & Access Nomic does not maintain a separate permission system. We enforce the access controls already configured in your source systems: SharePoint, Egnyte, Autodesk Construction Cloud, Bentley ProjectWise, Trimble ProjectSight. If a user cannot see a folder in the source system, they cannot see it in Nomic. We do not override, expand, or alter customer-defined access rights. Authentication options Direct login: Users can sign in to Nomic directly with email and password Single sign-on (SSO): Available via WorkOS, supporting SAML/OIDC with Azure AD, Okta, and other enterprise identity providers Access controls Multi-factor authentication (enforced via your IdP when SSO is used) Least-privilege access principles across the platform Role-based access (admin / member) with complete audit logging available to organization administrators Encrypted data in transit (TLS 1.2+) and at rest (AES-256) Data & File Indexing Files stored with Nomic are indexed using Nomic Platform infrastructure. When your data isn't being processed, it is stored only in your Nomic instance and is encrypted at rest. Indexing works by sending files or folders of files to the Nomic Platform embedding and parsing endpoints, where they are processed to generate searchable embeddings. Files are encrypted during transit and are only temporarily accessed for processing. Deployment Options and Data Nomic is a Nomic-managed cloud platform. Enterprise customers can choose multi-region data hosting to meet residency and compliance requirements, without on-prem or customer-VPC deployments. Nomic-Managed (Cloud) Our standard cloud offering where Nomic manages all infrastructure and operations in the AWS region selected for your deployment. All data is stored in Nomic-managed AWS infrastructure in Europe (Frankfurt), Australia (Sydney), the US (Oregon), or the UK (London) Data is processed through the Nomic Platform Processing involves our sub-processors as listed above Fastest deployment with minimal setup required Multi-Region Data Hosting (Enterprise) Keep customer data in the region that matches your compliance and residency requirements. Available regions: EU, AU, US, and UK. Data residency in your selected AWS region (Frankfurt, Sydney, Oregon, or London) Nomic-managed infrastructure and operations Processing involves our sub-processors as listed above No on-prem or customer-managed VPC required Need a Specific Region? For enterprise customers with compliance or data residency requirements, we offer multi-region hosting in the EU, AU, US, and UK. Contact our team at sales@nomic.ai to discuss your requirements. Subprocessors We rely on the following subprocessors to deliver our services. File-access markers indicate whether each subprocessor can access customer file content. AWS SEES AND STORES YOUR FILES Primary cloud hosting. Anthropic SEES YOUR FILES AI inference (under executed ZDR). OpenAI SEES YOUR FILES AI inference (under executed ZDR). Google Cloud Vertex API SEES YOUR FILES AI inference for Gemini models (under ZDR). Modal Labs SEES YOUR FILES Ephemeral compute for proprietary models. WorkOS NO FILE ACCESS Enterprise authentication and SSO. Sentry / Datadog NO FILE ACCESS Error and performance monitoring. Stripe NO FILE ACCESS Billing. Mixpanel / Google Analytics NO FILE ACCESS Product and web analytics. Loops NO FILE ACCESS Email communications. Exa AI NO FILE ACCESS Web search capabilities. Hosting: Nomic-managed deployments support AWS data hosting and residency in Europe (Frankfurt), the UK (London), the US (Oregon), and Australia (Sydney). No infrastructure in China, and no Chinese companies used as direct subprocessors. Subprocessor changes: Material changes to our subprocessor list are communicated with at least 15 days' advance notice. Customers may object on documented data protection grounds. See also: US State DPA · Global DPA Certifications & Evidence Independent attestation and continuous third-party validation. SOC 2 Type II: Annual independent audit covering security, availability, and confidentiality controls Penetration testing: At least annual third-party application penetration testing, with findings tracked through remediation Data Processing Agreement: Global DPA and US State DPA covering GDPR-aligned and US state data processing obligations Zero Data Retention: Executed ZDR agreements with all AI inference subprocessors Encryption: AES-256 at rest, TLS 1.2+ in transit Our DPA covers obligations under EU GDPR, UK GDPR, CCPA and other US state privacy laws, Brazil's LGPD, Australia's Privacy Act, and New Zealand's Privacy Act. Behind the trust center (NDA required) SOC 2 Type II report Penetration test report Anthropic Zero Data Retention Certificate Request access at security.nomic.ai. Data Deletion & Portability You retain full control over your data throughout the relationship. During the term, organization administrators can export user-generated content, usage logs, and audit data from the platform admin panel as CSV or JSON. At termination, at your election, we will either return your data in a commercially reasonable format or delete all customer data within 30 days using secure erasure methods. Written certification of deletion is available on request. Data subject requests (GDPR access, correction, deletion) are processed within one month of receipt in line with applicable law. See also: Privacy Policy, US State DPA · Global DPA · Terms of Service · Individual Terms of Service Vulnerability Disclosures & Incident Response For security researchers If you discover a security vulnerability, please report it to security@nomic.ai. Acknowledgment within 5 business days Regular updates throughout investigation Public disclosure coordinated after fix deployment Responsible disclosure guidelines: Provide detailed vulnerability information, allow reasonable time for fix development, avoid accessing or modifying user data, and do not perform testing that degrades service. For customers In the event of a security incident affecting customer data, Nomic notifies affected customers without undue delay in accordance with our Data Processing Agreement. Our security team coordinates with your designated point of contact through resolution. Legal Documents The right document depends on your relationship with Nomic. Privacy Policy : How we handle data from website visitors, demo requests, and newsletter sign-ups US State Data Processing Addendum : Governs how Nomic processes your data when you use the platform as a customer in the United States Global Data Processing Addendum : Governs international data processing obligations, including EU GDPR, UK GDPR, LGPD, and other regional privacy laws Terms of Service : Business and Enterprise Individual Terms of Service : Free and Individual Security & Compliance - Enterprise-Grade Data Protection | Nomic