Trust & Security
Last updated 2026-06-14
NOMOI LLC is a UAE based company building working tools for clinics, billing teams, and operators. This page is a plain statement of our security posture, the processors that touch product data, and where we stand on regulatory questions. We do not market compliance posture as a feature. If the page is out of date relative to what we operate, please write to [email protected] and we will correct it.
The name
Plato's Laws (Greek, Nomoi) is his last and longest dialogue, the only one without Socrates. In it, a stranger, a Cretan, and a Spartan walk from Knossos to the cave of Zeus, talking about law. Knossos is where Ariadne gave Theseus the thread. Plato says our inner cords pull us: iron for pleasure and pain, golden for reasoning. That golden cord is the law: gentle, yielding, needs helpers. NOMOI is named for this dialogue. Ari, soft-coral mascot, carries the thread.
Security infrastructure
- Encryption at rest using AES-256 for managed Postgres and object storage.
- Encryption in transit using TLS 1.2 or higher for every public endpoint.
- Production write access is limited to the founder. Operations are audit logged.
- Backups: encrypted snapshots on a separate provider. Secret material is age encrypted before any mirror sync.
- Incident response: notification to affected counterparties within 30 days of confirmed incident, in line with the Google Cloud HIPAA Business Associate Addendum signed on 2026-06-10.
- No live patient data is used in development or in any staging environment.
Cloud providers and data processors
The table below names every processor that may touch product data on our behalf and the status of the Business Associate Agreement or equivalent data processing addendum with that processor. Status TBD means a signed agreement is not yet in place and the processor is not in use for protected health information until that gap is closed. We update this table as agreements are signed or processors are removed.
| Provider | Used for | BAA | Region |
|---|---|---|---|
| Google Cloud (Vertex AI, GCS, Cloud SQL, Document AI) | Production LLM, storage, structured extraction | Signed 2026-06-10 | EU / US |
| Supabase | Application database, file storage | In review | EU Central |
| Cloudflare | DNS, edge tunnels, R2 for non PHI assets | Not applicable | Global |
| Coolify (self managed) | Container orchestration on operator hardware | Not applicable | EU / UAE |
| Twilio | WhatsApp and SMS for non clinical product flows | TBD | US |
| Mailgun | Transactional email | TBD, gated | EU |
| Zoho | SMTP for non clinical mail | No HIPAA option | EU |
| Google Workspace | Operator email and calendar | Signed via Google | EU / US |
| Anthropic | Claude models, routed via the LiteLLM gateway to Vertex AI | Covered via Google Cloud BAA on the Vertex route | US |
| CogniFit | Cognitive assessment delivery for the Cog Wellness product | TBD | EU / US |
| CNS Vital Signs | Cognitive assessment delivery for the Cog Wellness product | TBD | US |
| Sumsub | Optional identity verification for Cog Wellness | TBD | EU |
| Firebase (Firestore) | BreatheAct backend | Via Google Cloud, in review | me-central1 (Dubai) |
| OpenAI Whisper, Deepgram | Audio transcription (Cog Wellness debrief) | TBD | US |
"Used for" describes the operational role of the processor at NOMOI today. A "TBD" entry means we will not use that processor for protected health information in production until either the BAA is signed or the data is routed through a covered processor instead.
Regulatory posture
HIPAA: United States
NOMOI signed a Business Associate Addendum with Google Cloud EMEA on 2026-06-10 covering Vertex AI, Cloud Storage, Cloud SQL, Document AI, and the other services on Google's HIPAA covered list. The Anthropic Claude models we use route through the LiteLLM gateway to Vertex AI under that BAA, not the bare Anthropic API. The BAA does not on its own make NOMOI HIPAA compliant; it is one piece of the obligation chain. Our position is that HIPAA applies on the United States side of our work and only where we are objectively acting as a business associate of a covered entity.
United Arab Emirates: Federal Law 2/2019, ADHICS, MR 51/2021
NOMOI is domiciled in the UAE. UAE health data is governed by Federal Law 2 of 2019, the Abu Dhabi Healthcare Information and Cyber Security Standard (ADHICS) version 2.0 issued by the Department of Health, and Ministerial Resolution 51 of 2021 on cross border transfers. ADHICS Control CS 1.2 requires that the cloud environment processing UAE health information be physically hosted within the UAE, including backup and disaster recovery. Google Cloud does not currently offer a UAE region. We do not yet make a claim of full ADHICS or NABIDH compliance for our UAE health workloads. We are actively assessing the path to compliance, which includes one or more of: a UAE physical pod (Core42 sovereign cloud or comparable), on premise deployment at partner sites, or a Department of Health issued cross border exemption under ADHICS DP 1.4 where the use case fits one of the categories in MR 51/2021. We will update this page as decisions land. We do not market the products as UAE compliant in advance of that work.
GDPR and UK GDPR
Personal data of European Union and United Kingdom subjects is handled under our published privacy notice. We are the data controller for operator and clinic facing accounts; processors are listed above.
Psychometric work: Cog Wellness
The cognitive assessment work delivered through NOMOI Cog Wellness is interpreted by Assel Vinurra, Organizational Psychologist (MSc in Occupational Psychology, BPS member), BPS Registered Test User (Occupational: Ability and Personality), Register of Qualifications in Test Use member 473125, in force since 2021. This credential underwrites the right to administer and interpret the BPS standard psychometric instruments referenced in the Cog Wellness reports. It is distinct from BPS Chartership and from the protected practitioner titles regulated under the BPS Charter. NOMOI does not claim any of those protected titles, and no NOMOI surface should be read as asserting them.
Reporting a security concern
Email [email protected]. The founder reads this address. We acknowledge within one business day. If your finding requires a coordinated disclosure window, say so in the first message and we will respect a reasonable timeline.