Trust and compliance

NUADU sp. z o.o., Poland. Contact: hello@nuadu.ai.

A standard DPA is available for signature before any pilot involving personal data. Request it through the contact form; we return a signable copy rather than a questionnaire.

SOC 2-aligned controls, access on least-privilege, encryption in transit and at rest, role-based access control, and SSO via SAML or OAuth. NUADU is not currently presenting a completed SOC 2 Type II certificate; the controls are aligned to that framework and the current attestation status is confirmed in writing on request.

EU data residency is available on request. Regional hosting options for Southeast Asia are configured per deployment. Residency is fixed in the DPA, not decided at runtime.

GDPR-ready posture with documented lawful bases, configurable retention periods per programme, data subject request handling, and exportable evidence packages. FERPA posture documented for US institutional deployments.

Every AI output is logged and reviewable. AI prepares evidence and proposes; a named educator or approver decides and signs. EU AI Act obligations are mapped per AI capability so that the oversight model can be evidenced per decision rather than described in general terms.

A current sub-processor list, including hosting, speech and language model providers used for AI-assisted marking, is provided with the DPA and updated on change.

Assessments are delivered in the browser with keyboard navigation and screen-reader labelling on interactive controls. Accommodations — extended time, alternate formats, separate windows — are configured per cohort and recorded in the assessment record.

No downtime on record in operational history since 2020. Contractual availability commitments with named responsibilities are agreed per deployment; NUADU does not publish a blanket uptime SLA figure.