Built on trust.
Secured for scale.

Certifications & Compliance

Nomad XI undergoes rigorous independent audits and maintains certifications across major global privacy and security frameworks. These are not checkboxes — they represent continuous operational commitments backed by third-party verification.

The Four Pillars of Security

Our security program is structured around four independent pillars, each managed and audited separately. Together they form a layered defense-in-depth architecture that protects your data at every level.

GDPR & Global Privacy

Nomad XI is committed to full compliance with the General Data Protection Regulation (GDPR), U.S. State Privacy Laws (CCPA, CPRA, Texas TDPSA, and 15+ others), and all applicable international privacy regulations. We not only comply ourselves — we build the tools that help you comply with your own customer base.

HIPAA Readiness

For agencies and businesses operating in the healthcare space, Nomad XI provides a HIPAA-ready environment to securely manage Protected Health Information (PHI). This includes enterprise-grade encryption, strict access controls, and full Business Associate Agreement (BAA) support.

• AES-256 encryption of all PHI at rest
• TLS 1.2+ encryption of all PHI in transit
• Role-based access controls limiting PHI exposure to authorized personnel only
• Audit logs of all access to PHI-containing records
• Automatic session timeout for inactive users with PHI access
• Breach notification protocols meeting the HIPAA Breach Notification Rule
• Full BAA executed prior to any PHI processing

Data Handling Principles

We apply a strict set of internal data handling principles that go beyond minimum regulatory requirements. These principles guide every decision we make about how data is collected, stored, processed, and deleted.

• Data Minimization — We collect only the data necessary to provide the Services you have subscribed to. We do not collect speculative or precautionary data.
• Purpose Limitation — Data collected for one purpose is not reused for an incompatible purpose without appropriate legal basis or your consent.
• Storage Limitation — Personal data is not retained beyond what is necessary for its stated purpose. Retention schedules are defined and enforced per data category.
• Integrity & Confidentiality — All data is protected with appropriate technical and organizational security measures throughout its lifecycle.
• Accuracy — We provide you tools to keep your data up to date. We process correction requests within 30 days.
• Accountability — We maintain documented evidence of our data processing activities, legal bases, and compliance controls available on request from supervisory authorities.
• No Data Sales — We do not sell your Personal Information. We do not sell your customers' Personal Information. We do not sell SMS opt-in consent data under any circumstances.

AI & Data Ethics

Nomad XI integrates artificial intelligence features to enhance platform performance and automate workflows. We hold ourselves to a strict set of AI ethics principles to ensure your data is never used in ways you haven't authorized.

• Scoped AI Processing — AI features process your data only for the specific service you are using. Our instructions to AI sub-processors contractually limit their use of your data to that narrow scope.
• No Model Training on Your Data — Your data is never used to improve, fine-tune, or train generalized AI models shared across customers or released publicly.
• AI Sub-Processor Accountability — All AI sub-processors we work with are contractually bound to our data use limitations, security standards, and deletion requirements.
• Transparency — Features powered by AI are clearly identified. You may contact dpo@nomadxi.com for a current list of AI sub-processors and their data use scope.
• No Automated Decision-Making — We do not make solely automated decisions that produce legal or similarly significant effects about you.

User Privacy Controls

We believe privacy is a setting, not a policy. Here are the controls available to you directly within your Nomad XI account:

Data Rights & Requests

We honor all data subject rights requests under GDPR, CCPA/CPRA, and applicable U.S. state privacy laws. Here's how the process works:

• Submit your request — in writing to dpo@nomadxi.com — include your full name, email address, and the nature of your request
• Identity verification — we will ask you to verify your identity before processing any request; the verification method depends on the sensitivity of the data involved
• Response timeline — we acknowledge all requests within 5 business days and fulfill them within 30 days; complex requests may require up to 45 days with notice
• Appeal rights — if we deny your request or you are unsatisfied with our response, you may appeal by replying to our denial notice; we will reconsider and provide written reasoning
• Supervisory authority complaints — you have the right to lodge a complaint with your local data protection authority at any time; for EEA residents, contact your national DPA; for UK residents, the ICO at ico.org.uk

Incident Response

Despite our extensive preventive controls, no system is 100% immune to security incidents. We maintain a documented, tested Incident Response Plan (IRP) to minimize impact and ensure timely notification when a security event occurs.

• 24/7 monitoring — automated alerting and on-call security staff monitor for anomalous activity around the clock
• Containment — upon detecting a confirmed incident, affected systems are isolated within a defined time window to prevent lateral spread
• Assessment & forensics — we conduct a root-cause analysis to determine the scope, affected data categories, and number of individuals impacted
• Regulatory notification — we notify relevant supervisory authorities within 72 hours of confirming a breach, as required by GDPR Article 33
• Individual notification — where a breach is likely to result in high risk to individuals, we notify affected users without undue delay, per GDPR Article 34 and applicable U.S. state breach notification laws
• Remediation — we implement corrective measures and a post-incident review to prevent recurrence

Sub-Processors

We engage trusted third-party sub-processors to help us deliver the platform. All sub-processors are contractually bound to our data protection standards, including data minimization, security controls, and deletion obligations. We conduct regular Vendor Risk Management (VRM) reviews of all sub-processors.

Categories of sub-processors we engage include: cloud infrastructure (hosting, storage, CDN), payment processing, SMS/voice carriers, email delivery, customer support tooling, security monitoring, and AI feature providers. Each is scoped to process only the data necessary for their specific function.

International Transfers

Nomad XI operates globally. We may transfer Personal Information between the United States and our affiliates, sub-processors, and service providers in other countries — including India — to operate efficiently, improve performance, and maintain redundancy.

All international transfers are conducted in accordance with applicable law. For data originating in the EEA, UK, or Switzerland, we rely on the following transfer mechanisms:

• EU-U.S. Data Privacy Framework (EU-U.S. DPF) — certified for EU-to-US transfers
• UK Extension to the EU-U.S. DPF — certified for UK-to-US transfers
• Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) — certified for Switzerland-to-US transfers
• Standard Contractual Clauses (SCCs) — used as a supplementary mechanism where applicable

We may be required to disclose Personal Information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements. The Federal Trade Commission has jurisdiction over our DPF compliance.