Built to be
private.

No. Agents run on the enterprise AI platform you contract and TP Warehouse runs as a dedicated deployment in your cloud, in the region you choose. In product operation your data does not pass through Supernomial systems; model traffic runs under your agreement with your platform vendor.

During an engagement our people work inside your environment with identities you issue, for the time you set, under your terms. We keep no standing access and no credentials, and no copies of your data outside your environment beyond engagement correspondence and the working notes and deliverable drafts an engagement needs, which we delete within 30 days of its end under the Data Processing Agreement. Where we process personal data on your behalf, we do so in the EEA and, for engagements so scoped, inside your environment wherever you locate it; our people work from Finland and Germany.

No. We do not train models, on your data or anyone's. We do not train or fine-tune any model on Customer Content and do not permit anyone to do so on our behalf (Terms of Service, section 7.5). Nothing you author in your Customer Layer becomes training data through us.

The model vendor's own commitments on training sit in your Platform Agreement; check them at your platform's trust center, linked in the Security Notice.

No. Our controls are designed to meet the standards our clients are certified against: ISO 27001 internationally, SOC 2 in the United States. We have no certification and publish no audit report. For your review we answer your questionnaire, walk your security and data protection teams through each data path, and provide our policies under NDA.

We also have no third-party penetration test report of our own systems; you may test your TP Warehouse deployment in your own cloud under your rules. Your platform's and your cloud's certifications apply at the source: the Anthropic, Microsoft, OpenAI and Mistral AI trust centers are linked in the Security Notice.

Yes. Our Data Processing Agreement is accepted with every Order; no separate signature is needed, and a copy with a signature page is available on request at hello@supernomial.co. It applies whenever our people access your environment or receive your personal data in the course of engagement work: implementation, support, workshops on your real data and the AI Deployment Program. In product operation of Managed Agents, Private Agents and TP Warehouse nothing reaches us, and the DPA lies dormant.

Your AI platform vendor and your cloud provider process your data under your agreements with them; they are not our sub-processors. If your procurement process requires your own template, send it to hello@supernomial.co and we review it against ours.

None for product data: in product operation nothing reaches us, so no sub-processor touches it. For engagement work, Google Workspace carries engagement correspondence and deliverable drafts, and other tools only where your Order lists them (Data Processing Agreement, Annex III). For our website and company systems we use Vercel, Supabase, Resend, Google Workspace and GitHub, listed above with purpose, location and safeguard.

We give at least 30 days' notice of an addition or replacement, by email to the contact you name in the Order and by updating the list on this page.

Our agents are built for transfer pricing work by qualified professionals and are not intended for any use the EU AI Act lists as high-risk. The obligations for the underlying models sit with your AI platform. The transparency duties that apply since 2 August 2026 are met by design: agents are identified as agents, and their work passes your review before it leaves your organization. Our EU AI Act classification note is available on request.

The provider obligations for the models and the platform sit with your platform vendor under your Platform Agreement. We supply the instruction, knowledge and workflow components and implementation services, and we tell you if the intended purpose changes. If you repurpose the Materials for a use the Act lists as high-risk, you may become the provider of that system under Article 25 (Terms of Service, section 5.3). The AI inventory entry above gives the fields for your register.

What we ship is text your team can read: instruction files, knowledge, templates and workflows, kept in our code repository and delivered through the marketplace of your platform. The components of each release are listed in its release notes, and your administrators can review each release before installation. As delivered, the products contain no Supernomial endpoint, account, API key, license check or telemetry, and no Supernomial service is called at runtime. Some skills read public reference files (country profiles, industry benchmarks) from a repository we publish, at the moment they are used; that read goes to the repository host, not to us, and carries the requested file name, the requesting address, client software and the time, never your content.

Updates arrive through the marketplace channel you configure; the fetch carries no customer content, and where your platform supports it your administrators pin the reviewed revision and its digest. Updates do not alter the permissions, connectors or approval gates configured in your environment, and any update that adds a connector or an action needing new permissions is described in the release notes and disabled until your administrator enables it. We cannot and do not remotely disable software running in your environment.

Internet access: reference content is fetched read-only from public sources, web research runs only when a user asks for it, and access to your own systems goes through the connectors you approve on your platform. Where a deliverable is rendered to PDF and no LaTeX installation is found, the rendering script installs an open-source TeX distribution from its public mirror on first use; your administrators can pre-install it instead. No connection to any Supernomial system.

One deployment per customer: a managed database and sign-in platform in your own account plus the cloud platform we bring it up on with you, in the region you choose; no shared tenancy; both contracted by you. Agents reach it over MCP from inside your environment, and model calls go to the model vendor you configure. The baseline we implement with your team: TLS in transit; encryption at rest by the platforms you contract; sign-in through the deployment's identity service, with single sign-on through your identity provider where you configure it; least-privilege access for agents and people, enforced at the database; private networking where your policy asks for it and the platform supports it; an audit trail of who changed what and when; backups under your platforms' settings.

You keep the administrator roles, the infrastructure is contracted and billed to you, and we access the instance only as you authorize for implementation and support. TP Warehouse is delivered with an open-source notice file and a component list.

Inside your environment, the AI platform you contract. Outside it, no customer personal data goes into AI tools other than your environment or a tool named in your Order under terms that exclude training and fix retention (Data Processing Agreement, Annex II, item 5).

We use AI tools in our own engineering. A person reviews every change before it ships, and a transfer pricing expert reviews changes to knowledge and playbooks before release.

hello@supernomial.co is the channel, and the founders monitor it. We log, triage, contain and fix. If a security incident affects personal data we process on your behalf or a deliverable we shipped to you, we notify your named contact without undue delay, and in any event within 48 hours after becoming aware. The first notice may be partial and is completed as facts develop; a written post-incident summary follows; we make no public statement naming you without your consent, unless the law requires it.

Where we act as your processor, notice is timed so you can meet your own deadline under Article 33 GDPR. If a defect in shipped content could cause harmful agent behavior, we issue an advisory and a patched release.

Send your questionnaire (SIG, CAIQ or your own) to hello@supernomial.co; first response within 5 business days. We answer it and sit with your security and data protection teams until every question is closed. We provide an architecture walkthrough per offering, the Security Notice and Data & Security, the plugin release for your review before installation, our policies under NDA, and, for attachment to an Order, a copy of the security commitments in the Terms of Service and the Data Processing Agreement (Annex II).

Where documentation is not sufficient, you or an independent auditor may audit our compliance with the Data Processing Agreement at most once in any 12 months, on 30 days' written notice, within an agreed scope and at your cost (Data Processing Agreement, section 11).

Your agents and your warehouse keep running if our systems are down: they run on your platform and your cloud, and every engagement ends with documentation written so the system works without us. We cannot and do not remotely disable software running in your environment.

On termination the Customer Layer, Customer Data and Outputs stay with you in the formats they exist in; you may export them at any time, the Customer Layer as readable text (Terms of Service, section 7.6). The Managed Agents license ends with the fee and you uninstall the plugin within 30 days. For Private Agents and TP Warehouse, after at least 12 months of paid license you keep a license to the last delivered version without updates or support. We delete your confidential information in our possession within 30 days unless law requires retention, and transition assistance is available at the Order's rates for up to 90 days (Terms of Service, section 14).

Supernomial Oy, Business ID 3542056-6, Bulevardi 21, 00180 Helsinki, Finland. Our people work from Finland and Germany. Our services are offered to businesses, public bodies and professional firms acting in their trade or profession, not to consumers.

Our agreements are governed by the laws of Finland, excluding its conflict-of-law rules and the CISG; the District Court of Helsinki has exclusive jurisdiction, subject to the arbitration election on the Order and to injunctive relief in any competent court. Customers outside the EEA and Switzerland may elect arbitration under the Arbitration Rules of the Finland Chamber of Commerce (the Finland Arbitration Institute), seat Helsinki, in English (Terms of Service, section 15).