Security
Trust & Security
How we protect your data across Yavi.ai and Yavi.legal.
Security and privacy by design
Customer data is encrypted in transit and at rest, stays in the region the customer chooses, and is never used to train any large language model.
Infrastructure
Yavi's managed service runs on Microsoft Azure in US and India regions. Customer data is encrypted in transit and at rest, and enterprise customers choose the region where their data is stored and processed.
AI models and your data
Yavi works with diverse large language models, including Claude models from Anthropic. Nimbusnext never uses customer data to train any large language model. Each customer's documents are isolated to their own workspace, and retrieval only draws on content that customer has provided.
Data sovereignty and deployment options
SaaS
Hosted by Nimbusnext on Microsoft Azure, in US or India regions.
Customer cloud
Deployed in the customer's own environment on any major hyperscaler.
On-premise
Deployed inside the customer's own data center for full data control.
OEM
Yavi embedded in partner products under the partner's brand.
Data retention: Customers control access to their data, and Yavi follows each customer's data retention requirements and policies.
Access and security controls
- Single sign-on (SSO)
- Role-based access control (RBAC) for workspaces and documents
- Full audit logs of user and system activity
- Encryption in transit and at rest
Compliance
- Status:
- SOC 2 Type II audit for year 2 is in progress, expected January 2027.
- Documents on request:
- Current SOC 2 Type II report (under NDA) · Data Processing Agreement (DPA) · Security questionnaire · Subprocessor list
- Privacy:
- See our Privacy Policy.
Security FAQ
Where is our data stored and processed?
On Yavi's managed service, in Microsoft Azure regions in the US or India; you choose the region. You can also run Yavi in your own cloud on any major hyperscaler, or on-premise in your own data center.
Is our data used to train AI models?
No. Nimbusnext never uses customer data to train any large language model. Each customer's documents are isolated to their own workspace, and retrieval only draws on content that customer has provided.
Which AI model providers do you use?
Yavi works with diverse large language models, including Claude models from Anthropic. Our subprocessor list, available on request, names every provider that may process your data.
How long do you keep our data?
Yavi follows each customer's data retention requirements and policies, and you control access to your data throughout. Retention and deletion terms are set out in our Data Processing Agreement.
How is our data encrypted?
Customer data is encrypted in transit and at rest, and it stays in the region you choose. Our security questionnaire covers the specifics.
Do you support single sign-on and role-based access?
Yes. Yavi supports single sign-on (SSO) and role-based access control for workspaces and documents, and keeps full audit logs of user and system activity.
What happens if there is a security incident?
Customers are notified of incidents that affect their data under the terms of their agreement and Data Processing Agreement. To report a vulnerability, write to contact@nimbusnext.com.
What compliance documents can we review?
SOC 2 Type II audit for year 2 is in progress, expected January 2027. On request, we share our current SOC 2 Type II report (under NDA), Data Processing Agreement, security questionnaire and subprocessor list.
Have a question we have not covered? Ask our security team.
Responsible AI
Yavi is built on a human-in-the-loop model: answers cite their source documents, and people review and approve what agents do. We see AI as a tool for productivity, quality and efficiency, not as a replacement for people.
Read our Responsible AI principlesRunning a security review?
Get our SOC 2 Type II report, DPA, security questionnaire and subprocessor list, or walk through Yavi's security model with our team.