®
It does the work, then it stops and asks
Nova reads your workspace, shows every call it made, and proposes the change. Nothing is written until a person confirms it.
↳ Watch the sequenceSecurity / Data sovereigntySweden and the EU
Where the data actually sits.
Customer data is stored and processed in the EU, in Stockholm. Static delivery of this website runs over a global CDN, billing runs through Stripe, and a request to Nova reaches our model provider, currently OpenAI or Google, through the Lovable AI Gateway — each under standard contractual clauses where a transfer leaves the EU. Every part of it is checkable below.
Book a demo /30 min
The full roster is in the sub-processor list.
EULocationDatabase, authentication, file storage and edge functions all run in Stockholm.
30NoticeDays of written notice before any sub-processor is added or replaced, with fifteen to object.
99.5%AvailabilityMonthly uptime commitment, measured and credited under the service level agreement.
The data is yours.
The Terms say it in one line: Customer Data is owned exclusively by the Customer. We process it on your documented instructions and for no other purpose, under an Article 28 data processing agreement you can read before you sign anything.
We are the processor. You are the controller. That is not a courtesy, it is the arrangement, and it decides who may do what with the records in your workspace.
Read the processing agreement →- DatabaseSupabase — EU, Stockholm
- DeliveryCloudflare — global CDN. No customer data at rest.
- BillingStripe — EU (Ireland) or US under SCCs
- Model providerOpenAI or Google, reached through the Lovable AI Gateway — EU or US under SCCs
- ControllerYou
- ProcessorVenuvo AB
What covers a transfer.
Where a party sits outside the European Economic Area, the transfer runs on the European Commission’s standard contractual clauses under Implementing Decision (EU) 2021/914, on an adequacy decision where one applies, and on the supplementary measures the EDPB recommends in 01/2020 where a transfer impact assessment says they are needed.
Every party is contractually held to protections no weaker than the ones in our own agreement, and workspace content is not used to train any model. None of that is unusual; being able to read it before the call is.
What we hold, and why →Data at restStockholm
One location, named.
Not a region on a form. A region is a box someone ticked; a city is a place you can write into a data-processing agreement and hold us to. Customer data is stored and processed in the EU, in Stockholm, and every party that touches it is named in the sub-processor list, so there is nobody behind the list still to find.
Three things leave that position, and we say which. Static delivery of this website runs over a global CDN, billing runs through our payment processor, and a request to Nova reaches our model provider, each under standard contractual clauses where a transfer leaves the EU. The first two hold none of the records your team keeps in Venuvo OS. The third can carry workspace content in the request, which is why direct identifiers are removed from a tool result before it leaves.
StockholmEU
Read it rather than take it from us.
Four documents cover everything on this page, and they are published as signed rather than summarised into something friendlier.
Thirty minutes, your pipeline on the screen, no deck.
Tell us roughly how you work and we will come prepared.