Trust Center

This is the entry point for Nemorion Technologies' published compliance and trust documentation. Sovereign is a self-hosted-first platform: when you run a self-hosted deployment, Nemorion Technologies does not see your data and is not a Business Associate. This page describes the universal facts about that model. Compliance grade-specific documentation lives under linked sub-pages.

Sovereign is a project management and automation platform. Regulated data may incidentally pass through workflows or work items, but Sovereign is not designed to serve as an EHR, primary clinical-care system, or patient-record repository.

Compliance documentation

• HIPAA Compliance Alignment — platform controls mapped to the HIPAA Security Rule (§164.308, §164.310, §164.312) and Privacy Rule mechanisms.

Additional compliance grades (SOC 2 Type II, ISO 27001, FedRAMP, and others) will be added as they are pursued.

Deployment model and who is responsible for what

Sovereign ships in five tiers. Four are self-hosted; one is Nemorion Technologies-hosted.

If you self-host, Nemorion Technologies does not see your data and is not a Business Associate. The only data that leaves your environment is the license heartbeat (described below), which carries no customer-derived content. You do not need a BAA from Nemorion Technologies for self-hosted deployments.

License heartbeat disclosure

When a Connected (non-AirGapped) self-hosted deployment validates its license, it exchanges a heartbeat with Nemorion Technologies' license service. The exchange is bidirectional but carries no customer-derived content.

What your instance sends:

• License identifier
• Instance identifier (a randomly generated GUID for this deployment)
• The service emitting the heartbeat — optional
• Outbound IP address — optional

What Nemorion's response carries:

• License validation result
• Optionally: release notes, version-update advisories, security and feature notices that your instance can surface to operators

What the heartbeat does NOT include: tenant names, user counts, workspace names, work-item content, document content, audit log entries, connector credentials, or any other customer-derived data.

The AirGapped tier disables the heartbeat entirely and validates via local signature on the license file.

How to read compliance documentation

The compliance documentation pages use these status indicators consistently:

• ✓ Supported — Controls are in place in production.
• ⚠ Partial — Controls are in place with a documented gap or a customer-configuration requirement. The gap is described.
• ◯ Customer Responsibility — The safeguard is outside the software's reach (for example, physical security of the server). The software does not impede compliance; the operator implements.
• ⧖ In Progress — Active development.

Reporting discrepancies

If a claim in our compliance documentation does not match the platform's current behavior, treat it as a defect and report it to nemoriontechnologies@gmail.com.

Next steps

• HIPAA Compliance Alignment — Security Rule and Privacy Rule mappings.
• Security Overview — broader platform security posture.
• Data Protection — credential encryption, message queue security, license enforcement.
• Authorization & Compliance — role-based authorization and audit logging.
• Authentication Setup — configure OIDC, Local, or Bypass mode.