Security at Niobia AI

Every Niobia AI account, including free Starter and Student plans, is protected with strong encryption. All data in transit is protected with TLS 1.3, and all data at rest is encrypted using AES-256.

Starter and Student plans run on shared-cloud infrastructure hosted on Google Cloud Platform (GCP). Inherited protections include default encryption at rest for all data written to storage, infrastructure-level isolation through physically secured data centers with layered access controls, and encrypted inter-service communication throughout the platform.

We do not use your data to train foundation models or any general-purpose models offered to other customers or third parties. When Niobia uses third-party model providers, those providers are not permitted to train on your data. Starter and Student plans run on shared infrastructure, so Niobia may process customer data on those plans to operate, secure, support, and troubleshoot the shared service. Each user and workspace remains logically isolated from other users.

The Professional plan includes everything in Starter and Student, plus security features designed for collaborative teams handling sensitive R&D data.

Team workspaces are encrypted in transit (TLS 1.3) and at rest (AES-256), with workspace-level logical isolation that keeps shared formulations, experimental results, and analysis workflows confidential within your organization. Audit logs and activity tracking provide full visibility into who accessed what data and when, supporting internal compliance requirements.

Organization-level roles and permissions enforce least-privilege access. Team members only see what they need. Organization boundaries are logically isolated within the shared platform, ensuring strict separation between different customer workspaces.

Professional also includes a stronger data-use boundary for platform improvement: Niobia does not use raw customer data or raw prompts from Professional accounts to improve the platform. Platform improvement for Professional is limited to aggregated, de-identified, or higher-level service telemetry derived from operating the Service.

For organizations handling export-controlled materials, proprietary formulations, or data subject to strict regulatory requirements, Niobia AI offers fully dedicated, single-tenant infrastructure on isolated Niobia-managed GCP infrastructure. No compute or storage is shared with any other customer.

Where provisioned, you hold the encryption keys. With Customer-Controlled Keys (BYOK), Niobia AI cannot decrypt your data without your explicit permission. Your data is stored and processed only in the geographic region you specify.

The architecture is secure by design. Niobia AI controls only the control plane: application logic, orchestration, and updates. The customer controls the data plane: where data lives, who can access it, and, where provisioned, the encryption keys. Niobia AI does not use raw customer data from this deployment model for platform improvement.

This is the customer-controlled deployment option: Niobia AI runs as a compute workload inside your existing cloud or data platform environment. Data stays in that environment unless you explicitly choose otherwise. Niobia AI does not use raw customer data from this deployment model for platform improvement.

Niobia can deploy this model into customer-controlled platforms such as Snowflake, Databricks, or other approved cloud environments. Where the platform provides native governance and networking controls, Niobia runs inside that control boundary rather than requiring data movement into Niobia-managed infrastructure.

• Customer-controlled access policies including RBAC, ABAC, or row-level controls where supported by the customer platform
• Customer networking boundaries so platform traffic follows the customer’s approved network architecture
• Customer-selected encryption and key-management posturewhere the platform supports it
• Explicit support-access controls so Niobia engineers only access deployed systems or data when the customer grants permission

In this model, the customer controls the environment and grants Niobia the permissions needed to deploy, operate, and support the platform. Niobia AI engineers do not access customer data unless the customer explicitly grants support permissions.