GDPR
The short version
Niro is built to be used by companies in the UK and the EU. We follow UK GDPR and EU GDPR.
If you need our Data Processing Agreement, you already have it. It applies automatically when you sign up. You do not need to ask, sign anything, or negotiate.
Read the Data Processing Agreement
Who is responsible for what
When you connect a repository, you decide what goes into Niro. That makes you the controller.
We only do what you tell us to do with it. That makes us the processor.
In practice this means we will not do anything with your code except run the service you signed up for. We will not look through it, share it, or use it for our own purposes.
The questions we get asked most
Do you train AI models on our code? No. Our DPA says so as a binding promise, not a marketing line. We have also turned off data retention with every AI supplier we use, so they do not keep your content either.
Where is our data held? Ireland, inside the EEA. Two AI suppliers are in the United States, and we have the standard European Commission clauses in place for those.
Who else can see it? Only the suppliers on our Sub-processors page. Nobody else.
Can we get it deleted? Yes. Disconnect a repository and its data goes. Close your account and everything goes. Ask us in writing and we will confirm in writing once it is done.
What if there is a breach? We tell you within 72 hours of knowing about it, with what we know at the time. That gives you time to meet your own 72-hour deadline with your regulator.
Can we audit you? Yes. Start with our security documentation and a questionnaire. If that is not enough, we will run a live screen-sharing session and show you the systems. We have no offices, so there is nowhere to visit in person.
Do you have a Data Protection Officer? No, and we are not required to have one. We checked this properly against the legal test and wrote down the answer. Our Information Security Officer handles data protection. Email privacy@niro.ai.
What we are still working on
We would rather tell you this than have you find it later.
- Multi-factor authentication on the Niro platform is not available yet. We are building it. Our own company accounts all have it.
- We do not hold ISO 27001 or SOC 2 yet. Both are in progress. We have written the full policy set, done the risk work, and can share it under NDA today if that helps your review.
Documents you can have
Available now:
- Data Processing Agreement
- Sub-processor list
- Our security policies, under NDA
- A completed security questionnaire
Coming:
- ISO 27001 certificate
- SOC 2 report
- Penetration test report
Email privacy@niro.ai and ask.