Security & data
Your data stays yours.
Nuqo is built for manufacturers who can't send drawings and part data just anywhere. You know where your data lives, it stays encrypted end to end, and it's never used to train third-party AI models.
Data residency
Where your data lives
Your documents, quotes, and account data are stored and hosted in the EU. The AI that reads your documents runs in the EU too, unless your contract allows other regions.
Data and hosting in the EU
Your documents, quotes, and account data are stored in the EU.
- Application hosting — Hetzner, Germany
- Database — Neon (PostgreSQL), EU region
- File storage — Cloudflare R2, EU
AI processing of your documents in the EU by default
The AI models that read your drawings and BOMs run in the EU.
- Azure OpenAI — EU Data Zone
- Google Vertex AI — EU multi-region
- Other regions only where your contract allows it
- Microsoft Bing — web lookup of single parts, no documents; outside the EU, only where your organisation has switched it on
Data protection
How your data is protected
Your data stays yours. Where we rely on external AI providers, we use only endpoints that are contractually barred from training on your data.
Encrypted in transit & at rest
All data is encrypted in transit over TLS and encrypted at rest by our infrastructure providers. Passwords are hashed with Argon2id.
Role-based access & secure sessions
Access is controlled by role-based permissions. Sessions use HttpOnly, SameSite, and Secure cookies, backed by regular security updates and monitoring.
Every price is traceable
Nothing is a black box. Every material price and labor step links back to the source document or catalog it came from — so you can audit each number.
Human oversight
A human confirms every quote before it goes out
Nuqo does the heavy lifting — reading documents, matching parts, pricing labor — but it never sends a quote on its own. Your estimator reviews the result, answers the questions Nuqo flags, and presses go. AI drafts; people decide.
Connector -X1 (12-way): Contact plating not stated on the drawing — tin or gold? It moves the line price by ~40 %.
Core 0.75 mm² to -B1: Length 0.29 m derived from the conduit callout — please confirm against the production list.
- 1
Nuqo flags what it's unsure about
Instead of guessing, Nuqo raises clarifying questions next to the exact source document — ranked by importance.
- 2
Your estimator reviews and answers
You confirm matches, edit anything you need to, and add expertise the documents didn't spell out.
- 3
You press go
Nothing is finalized until a person confirms it. The quote is yours to send once you're satisfied.
Auditability
Every change is logged — and reversible
Quoting is a joint effort between your estimators and Nuqo's AI, so every change to a quote is recorded automatically — and any earlier state can be brought back in one click.
Discount changed from 5% to 10%
Parts matched (12 / 14)
Added 2 BOM lines, modified 3
Finalized revision 2
Extraction complete
Uploaded 2 documents · harness_bom.xlsx, drawing_rev_c.pdf
A complete audit log
Every change is captured automatically — who made it, when, and what changed.
- Manual edits, AI copilot actions, and system recalculations — all recorded
- Every entry names who and when, in plain language
- Line-level precision: exactly which BOM rows and prices changed
Restore any earlier state
Preview how a quote looked at any point in its history, then restore the whole quote to that state in one click.
- Read-only preview before you commit
- Nothing is ever overwritten — the restore is logged too
- Jump back or forward to any point, as often as you need
Compliance
Compliance you can verify
Enterprise-grade data protection and security practices — in place today and documented for your security review.
In place today
- GDPR-compliant processing
- Signed Data Processing Agreement (Art. 28 GDPR)
- Data and hosting in the EU; AI processing of your documents in the EU by default
- Encryption in transit and at rest
- Role-based access control and secure sessions
- Full audit log of every quote change, with one-click restore
- Two-factor authentication (on request)
- Regular internal penetration testing
On our roadmap as we scale
SOC 2 and ISO 27001 are planned for our next stages of growth. Until then, the controls above and our DPA give you concrete assurances today.