Security & data protection

Noetava exists so you can put an AI to work on your own information without handing it to a public chatbot. Here is exactly how we protect it. If your organisation needs a signed Data Processing Agreement, email privacy@noetava.com.

Private by design

Every AI is trained only on the content you provide and is accessible only to your account. We never pool customer documents or use your data to train shared or public models.

Encrypted in transit and at rest

All traffic uses HTTPS, and your documents and database records are encrypted at rest by our storage and database providers.

Isolation & access control

Accounts are separated at the database level, and access is authenticated on every request. Your published AIs only ever answer from your own knowledge.

No third-party AI, ever

Your content is never sent to OpenAI or any other third-party AI model. Your private model is run only for you and is never shared with other customers. It is used only to build and run your AI, never sold, shared, or used to train a model for anyone else.

Your rights under UK data protection law

Access & portability

Download everything we hold in one click from your Account page.

Erasure

Delete your account and all associated data, immediately and permanently, from Account.

Rectification

Edit your AIs, knowledge, and brand at any time; remove individual documents instantly.

Objection / restriction

Email us and we'll action it. We never use your data for advertising or to train shared models.

Sub-processors

We use a small number of trusted providers to run the service. Each handles data only to deliver Noetava to you, under their own data-protection terms.

Provider	What it does
Supabase	Account database, authentication, and storage of your content (text, embeddings, and chat history)
Cloudflare R2	Storage for your uploaded documents, datasets, and brand logos
Vercel	Hosting for the web app and published chat pages
Stripe	Subscription billing (card data never touches our servers)
Resend	Transactional email (e.g. lead notifications)

Compliance roadmap

We build to UK data protection law (the UK GDPR and the Data Protection Act 2018) today. Formal certifications (Cyber Essentials, and ISO 27001 for larger engagements) are on our roadmap. If a certification or specific data-residency arrangement is a requirement for you, talk to us before you sign up and we'll tell you honestly where we are.