Trust and security

1. How is the data scope defined?

The client approves which data sources Cerenovus can read for the agreed review. The client can limit access to a single source, channel, column, or folder.

2. Where is data hosted and how long is it kept?

In the standard setup, each client gets a separate cloud environment. Network access is limited to approved client transfer paths and authorized Cerenovus operations. Clients can also run Cerenovus in their own cloud or on their own premises to meet security, data residency, or control requirements.

Cerenovus keeps data only for the agreed work period, following the retention schedule and any limits the client already has.

3. Is customer data used to train models?

Cerenovus does not use customer data to train its models. Model providers process data under the commercial terms for the chosen deployment.

4. What is the current certification status?

Cerenovus is pursuing SOC 2 Type II and ISO 27001 certification and has not yet completed either. Clients can arrange confidentiality and data processing agreements during onboarding.

5. How does Cerenovus analyze company data?

Cerenovus reads company data, matches the same companies and people across sources, and prepares findings within the approved scope. It uses public information only when the client approves. Model choice and hosting depend on the client environment. Clients can run local models on their own infrastructure.

• Cerenovus gathers information for the approved questions.
• External searches stay within the agreed scope, and search queries exclude confidential information.
• Clients receive findings they can check. System integrations are scoped separately.
• Reviewers can open the documents and datasets behind each finding and check how they connect.