Your people's knowledge, protected.
Nucleus OS holds some of your most sensitive material: policies, product plans, and how every person performs. Here is how we protect it, who we share it with, and what happens to it inside our AI features.
Four pillars, built in from day one.
Data protection
Customer data is encrypted in transit and at rest, and every administrative action is written to an audit log.
- Encryption in transit and at rest
- Audit logging on every action
- Tenant data logically isolated per organization
Identity & access
Access follows your identity provider and your org chart, not a shared spreadsheet of logins.
- SAML 2.0 single sign-on with any standards-compliant IdP
- SCIM 2.0 provisioning and deprovisioning
- Two-factor authentication on every account
- Custom roles for admins, creators, managers, and learners
Privacy & compliance
Data handling is designed around GDPR principles: purpose limitation, minimization, and the rights of the people in your programs.
- GDPR-ready workflows for access, export, and deletion requests
- Data processing agreement available on request
- A published, maintained list of subprocessors
Infrastructure
Nucleus OS runs on Google Cloud Platform, with managed services for storage, databases, and authentication.
- Hosted on Google Cloud Platform
- Regional deployment where your compliance team requires it
- Managed, patched infrastructure services
Security features on every plan.
Encryption
Data encrypted in transit and at rest, with audit logging on every action.
SAML single sign-on
One secure login through your identity provider.
SCIM provisioning
Users provisioned and deprovisioned automatically.
Two-factor auth
2FA available on every account.
Custom user roles
Granular permissions for admins, creators, and learners.
SCORM, xAPI & LTI
Your existing course standards, supported natively.
Regional deploys
Deploy in the region your compliance team requires.
GDPR-ready workflows
Data handling designed for GDPR from day one.
Your content trains nobody else's AI.
Customer content, including the documents you upload, the courses you build, and the questions learners ask AI tutors, is used only to provide the service to your organization. It is not used to train models for other customers.
AI features send only the content needed to complete a request to our model provider, listed below as a subprocessor. AI tutors answer from your approved material, and generated content passes through review before it is published.
Who else touches your data.
The third parties that process customer data on our behalf to deliver Nucleus OS. We keep this list current as our infrastructure changes.
| Subprocessor | Purpose | Data involved |
|---|---|---|
| Google Cloud Platform | Hosting, storage, and database infrastructure | All customer data |
| Firebase (Google) | Authentication | Account identifiers and credentials |
| MongoDB Atlas | Database | Customer content and learning records |
| Stripe | Payments | Billing contact and payment details |
| Google Workspace (Gmail) | Transactional email | Names and email addresses |
| OpenAI | AI model processing | Content and prompts submitted to AI features |
Found a vulnerability? Tell us.
How to report
Email admin@nucleusinstitute.com with “Security” in the subject line. Please include:
- The affected URL, feature, or endpoint
- Steps to reproduce, with screenshots or a proof of concept
- The impact you believe it has
- How we can reach you for follow-up
Safe harbour
If you make a good-faith effort to follow this policy, we will not pursue legal action against you for your research, and we will work with you to understand and resolve the issue quickly.
In return, we ask that you avoid accessing or modifying other users' data, avoid degrading the service, do not use social engineering or physical attacks, and give us reasonable time to fix the issue before disclosing it publicly.
Security questions, answered.
Request our security package.
Policies, architecture overview, subprocessor details, and our DPA, sent to your security and legal teams.