Security & compliance
Last updated:
Security starts with an agreed deployment and evidence you can inspect. Use the checklist below to review your data, access, testing and service requirements before signing. Product features and contractual commitments must be confirmed for the configuration you buy.
Customer privacy · Platform & CRM
Your customers’ personal data.
Your key. Your control.
You hold the key to access your customers’ personal data.
nuke.ai has no access to your customers’ personal data.
This promise applies to the nuke.ai platform and CRM.
This promise concerns customer personal data in our platform and CRM. Contact details you choose to share through this website or demo booking are covered by the website privacy notice.
Privacy
Under your control
nuke.ai has no access to your customers’ personal data.
1. Data residency
Agree where production data, backups and disaster-recovery copies will be stored. Document permitted transfers, subprocessors, retention and deletion responsibilities for every market.
Your hardware. Your cloud. Or both.
The same engine ships native to every host posture — bare-metal compliance, AWS-first elasticity, or a hybrid edge that splits the difference. Pick what your jurisdiction, ops team, and CFO each need. None of them lose.
Native to your hardware.
Run the full engine inside your own datacenter. Bare metal, Kubernetes, or fully air-gapped — same APIs, zero feature drift versus the cloud build.
Cloud-first elasticity.
Ships natively on AWS — managed control plane, regional data residency, and IAM-aligned access. Auto-scales horizontally on every event spike.
Best of both, one ledger.
Keep regulated brands on-prem, run growth markets in the cloud, share a single wallet ledger. Mesh routing handles cross-surface traffic transparently.
2. Encryption
Request the encryption architecture for data in transit and at rest, key ownership, rotation procedures and recovery controls. Verify the endpoints and data flows in your proposed deployment.
3. Access controls
Demonstrate sign-in, MFA, role permissions and separation between brands. Test sensitive actions with a restricted account, and inspect audit records and access-revocation procedures.
4. Penetration testing
Request the latest independent assessment: issuing firm, date, tested versions, scope, exclusions and remediation status. Confirm retesting and contractual response targets; do not assume a fixed cadence or SLA.
5. Certifications
Review certificates and assessment reports against the exact holder, products, versions and jurisdictions. Confirm payment-data flows and PCI responsibilities separately. A product certificate is not an operator licence or a blanket security guarantee.
6. Vulnerability disclosure
Security researchers can disclose findings to security@nuke.ai. Include the affected URL or version and safe reproduction steps. Do not send player records, credentials or payment data. Any response times and disclosure arrangements must be agreed with the security team.
7. Incident response
Ask for the security evidence and service terms relevant to your proposed deployment: assessment scope and date, access controls, incident response, availability commitments and data residency. Confirm these during due diligence; this page is not a live uptime monitor or a certification.
8. Contact
Security inquiries: security@nuke.ai.
General compliance: compliance@nuke.ai.