Security & data protection
Noetava exists so you can put an AI to work on your own information without handing it to a public chatbot. Here is exactly how we protect it. If your organisation needs a signed Data Processing Agreement, email privacy@noetava.com.
Private by design
Every AI is trained only on the content you provide and is accessible only to your account. We never pool customer documents or use your data to train shared or public models.
Encrypted in transit and at rest
All traffic uses HTTPS, and your documents and database records are encrypted at rest by our storage and database providers.
Isolation & access control
Accounts are separated at the database level, and access is authenticated on every request. Your published AIs only ever answer from your own knowledge.
No third-party AI, ever
Your content is never sent to OpenAI or any other third-party AI model. Your private model is run only for you and is never shared with other customers. It is used only to build and run your AI, never sold, shared, or used to train a model for anyone else.
Your rights under UK data protection law
Sub-processors
We use a small number of trusted providers to run the service. Each handles data only to deliver Noetava to you, under their own data-protection terms.
| Provider | What it does |
|---|---|
| Supabase | Account database, authentication, and storage of your content (text, embeddings, and chat history) |
| Cloudflare R2 | Storage for your uploaded documents, datasets, and brand logos |
| Vercel | Hosting for the web app and published chat pages |
| Stripe | Subscription billing (card data never touches our servers) |
| Resend | Transactional email (e.g. lead notifications) — sent from EU (Ireland) infrastructure |
| Modal | GPU capacity for smaller training jobs, in EU datacentres — not used if you choose UK-only training in Account settings. Serving always runs on hardware we own in the UK |
Company & registration
- Noetava is operated by MRD Assets Limited, registered in England and Wales — company number 15731565.
- Registered with the UK Information Commissioner's Office (data protection fee paid) — registration reference 00015098067, verifiable on the ICO public register.
- Our data protection contact is privacy@noetava.com.
Compliance roadmap
We build to UK data protection law (the UK GDPR and the Data Protection Act 2018) today. Your AI is always served from hardware we own and operate in the United Kingdom; smaller training jobs may run on Modal's GPUs in EU datacentres, and you can choose UK-only training for your organisation or for any individual training job. Formal certifications (Cyber Essentials, and ISO 27001 for larger engagements) are on our roadmap. If a certification or another specific arrangement is a requirement for you, talk to us before you sign up and we'll tell you honestly where we are.