NEBIS.AI / SECURITY AND DATA
Your clients' data, handled the way an audit file should be.
Where the data lives, who can see it, what the AI may do with it, and what happens when you leave. Client data is never used to train AI models.
Where it lives
Hosted in Singapore.
Singapore region
The audit workspace runs on Microsoft Azure in its Singapore region. Storage is copied across availability zones inside Singapore and is not replicated to another region.
Backups in Singapore
Backups are taken every 24 hours and kept for 30 days, in Singapore.
Encrypted
Data is encrypted at rest and in transit.
Who can see it
Each firm sees only its own work.
Firm by firm
A firm sees only its own engagements. Staff see the engagements they are named on; partners and managers see their firm's.
Restricted roles
Customer due diligence content is visible only to the firm's Risk Management role, which is set at onboarding and never self-assigned.
Nebis access is limited
Nebis staff open a firm's engagement only under support access. Infrastructure administration is limited to named people and recorded.
Everything on the record
Every change, sign-off and upload is stamped and kept in the engagement's audit trail, and goes into the archive.
AI and your data
AI under data processing terms.
No training on client data
Client data is not used to train AI models. AI providers process it under data processing terms, and keep it only for the limited period their terms allow.
Approved models only
Nebis decides which AI model may perform each task, and a model is used only after it passes that task's tests. Your firm does not manage models or keys.
Processing outside Singapore
AI processing may take place outside Singapore. Where personal data is transferred overseas, it is protected to a standard comparable to the PDPA.
Contract and PDPA
On your instructions, on paper.
Data processing terms
Nebis processes your clients' data on your firm's instructions under written data processing terms, which name the sub-processors.
Retention and exit
Your firm keeps its retention obligations. When a firm leaves, it can download a final export, after which its data, archives included, is deleted.
Data Protection Officer
Questions about personal data go to our Data Protection Officer at [email protected].
Questions
Asked and answered.
Is it PDPA-compliant to use AI on client data in an accounting firm? +
Where is the data stored? +
Is our client data used to train AI? +
Can we see the list of sub-processors? +
Bring your security questions to the call.
We will take you through the data processing terms and the set-up behind them.