---
title: "Data Processing Addendum"
description: "How Nace.AI processes personal data in Customer Content on a customer's behalf."
canonical: "https://nace.ai/policies/data-processing-addendum"
---

# Data Processing Addendum

> How Nace.AI processes personal data in Customer Content on a customer's behalf.

**Last Revised: October 26, 2026 · Published at [https://www.nace.ai/policies/data-processing-addendum](https://www.nace.ai/policies/data-processing-addendum)**

This Data Processing Addendum ("DPA") is made between Nace.AI, Inc., a Delaware corporation with its principal office at 366 Cambridge Ave, Palo Alto, CA 94301, USA ("Nace"), and the customer that has accepted the Nace.AI Terms of Service or signed a Separate Agreement ("Customer"). It forms part of the Terms of Service at [https://www.nace.ai/policies/terms-of-service](https://www.nace.ai/policies/terms-of-service), or of the Separate Agreement that refers to it (each, the "Agreement").

How this DPA takes effect. This DPA applies automatically, from the moment processing begins, whenever Nace processes personal data contained in Customer Content on Customer's behalf. Customer accepts this DPA when it accepts the Agreement; no separate signature is required. If Customer needs a countersigned copy, it may request one at [support@nace.ai](mailto:support@nace.ai) using the signature block in Schedule 1. If Customer and Nace have signed a different data processing agreement, that signed agreement governs instead of this DPA.

## 1. Scope, roles and priority

**1.1** This DPA applies to Customer Data processed by Nace or its Subprocessors in providing the Services, through every Access Method, including the Console, APIs, CLI, SDKs, MCP Server and interactive playgrounds, and for both Perception and Decision models (including Drex).

**1.2** Customer decides what Customer Content to submit and for what purpose. Nace processes Customer Content on Customer's behalf, as Customer's "service provider" or "processor" (as those terms are used in applicable data protection laws), under this DPA and Customer's lawful instructions. Customer is responsible for having the rights, and for giving any notices and obtaining any consents, needed to submit Customer Data to the Services.

**1.3** If this DPA conflicts with the Agreement, the Privacy Notice, the Documentation or any product setting, this DPA controls with respect to Customer Data. A product setting, Console option or account configuration cannot reduce the protections in this DPA. Stronger commitments in a Separate Agreement continue to apply.

**1.4** Customer must not submit Prohibited Data (as defined in the Terms of Service, for example health information subject to HIPAA, full payment card data, credentials and biometric data) unless a Separate Agreement expressly permits it. This DPA does not authorise the submission of Prohibited Data.

## 2. Definitions

Capitalised terms not defined here have the meanings given in the Agreement.

"Customer Content" means Inputs (documents, files, images, text, prompts, questions, state information, parameters, schemas and other materials submitted to the Services) and Outputs (results returned by the Services), together with any copy, extract or representation derived from them that could reveal or reconstruct their substance (such as converted documents, page images, parsed text, embeddings and indexes), whether or not they contain personal data.

"Operational Metadata" means content-free records about use of the Services, such as request identifiers, timestamps, model and endpoint identifiers, file type, page and token counts, credits consumed, latency, status and error codes, partially masked API key identifiers, a content-free outline of each request (field names and counts, without any values), and request reference codes supplied by Customer. It excludes Customer Content and any excerpt of Customer Content, including content captured in error logs or traces, document text, prompts, results, original file names and content-bearing free-form errors. Operational Metadata may contain opaque operation, Account, organization, API-key and idempotency identifiers, so removing direct user attribution does not make it anonymous.

"Customer Data" means Customer Content, Operational Metadata, and Customer's account, contact and billing information processed in connection with the Services.

"Saved Content" means Customer Content that Customer keeps using a persistence feature of the Services (for example, workspaces, saved schemas, drafts, runs or stored results). Saved Content follows the same Standard retention as other Customer Content under Section 4.1.

"Zero Retention" means the optional mode described in Section 4.3, available for supported operations in workspaces bound to Customer-Managed Storage.

"Customer-Managed Storage" means Amazon S3 or Azure Blob Storage that Customer controls and binds to a workspace, where that option is available.

"Subprocessor" means a third party engaged by Nace that processes Customer Data on Nace's behalf, including hosting, infrastructure, storage, workflow and AI model inference providers.

"Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Data in the possession or control of Nace or its Subprocessors. Unsuccessful attempts that do not compromise Customer Data (such as blocked log-in attempts or port scans) are not Security Incidents.

"Applicable Data Protection Law" means all privacy and data protection laws that apply to the processing of personal data in Customer Data, including the California Consumer Privacy Act as amended and other U.S. state comprehensive privacy laws.

## 3. Permitted processing

**3.1** Nace will process Customer Content only (a) to provide, maintain, secure and support the Services for Customer in accordance with the Agreement and Customer's use and configuration of the Services (including the retention mode Customer selects and any deletion Customer requests), which together form Customer's instructions. Storing Customer Content under Section 4 does not authorise any other use, including model training; (b) to prevent abuse of the Services; and (c) to comply with a binding legal requirement.

**3.2** Nace will not: (a) sell or share Customer Content or personal data in Customer Data, including for cross-context behavioural advertising; (b) use Customer Content for advertising; (c) retain, use or disclose Customer Content for any purpose other than those in Section 3.1, or outside the direct business relationship with Customer; or (d) combine personal data in Customer Content with personal data it receives from other sources, except as permitted by Applicable Data Protection Law. Nace understands and will comply with these restrictions.

**3.3** Nace personnel may review specific Customer Content only where necessary to troubleshoot a request Customer reports or to provide support Customer asks for, and only for that purpose.

**3.4** Nace will promptly tell Customer if it believes an instruction violates Applicable Data Protection Law, and may pause the affected processing while the parties resolve the issue. Nace will also notify Customer if it can no longer meet its obligations under Applicable Data Protection Law.

## 4. Retention and deletion

**4.1** Standard retention. In Standard mode, Nace retains Customer Content, including workspace files, uploads that have not entered processing, Inputs, Outputs, saved schemas, drafts, runs and derived artifacts, until Customer instructs deletion, closes the applicable Account or workspace, or another deletion obligation under this DPA or an applicable Separate Agreement applies. No automatic expiry applies solely because of content age, free or paid status, or inactivity, and expiry of a credit balance, download link or access token does not delete content. Temporary processing copies and caches are kept only as long as needed to provide the Services. This Section does not expand the purposes for which Nace may use Customer Content. It applies to all Customer Content, including content submitted before it took effect, from the effective date stated in Nace's advance notice of the change.

**4.2** Saved configuration and Customer-Managed Storage. Some saved configuration, such as classification domains, cannot be deleted through the Services because existing results depend on it; it is kept until Customer's Account or organization is closed, or deleted within 72 hours of a request to [support@nace.ai](mailto:support@nace.ai). Where available, Customer may bind a workspace to Customer-Managed Storage. Customer controls the lifecycle, access, versions and backups of objects in that storage, and the deadlines in this Section for deleting Nace-held copies do not govern copies remaining under Customer's control. Automatic Zero Retention cleanup does not erase Customer's source files, outputs or processing objects in that storage. Explicit deletion through the Services is a separate Customer instruction and may remove service-created objects using the storage binding. Disconnecting a storage binding does not itself delete its objects.

**4.3** Zero Retention. Account owners and administrators may enable Zero Retention. It applies only to supported operations using workspaces bound to Customer-Managed Storage. While it is enabled, Nace-managed workspaces and standalone uploads are unavailable for new processing, and operations that cannot meet this Section are refused before any content is processed rather than processed under Standard retention. Enabling it does not migrate or erase pre-existing workspace files. Supported results are delivered through a transient delivery mechanism. When Zero Retention is enabled:

(a) Nace-held temporary Customer Content, including caches, is deleted from active systems within 1 hour after results are delivered or the request fails or is cancelled;

(b) Customer Content is not written to previous file versions, logs, traces or training datasets, and is held in databases or caches only transiently while it is processed and delivered. Content entered in the Console's interactive document workbench (drafts and runs) may be included in Nace's encrypted database backups, which expire within 35 days;

(c) Nace sends Customer Content only to Subprocessors that are contractually bound not to retain it beyond the request and not to use it for training (fallback processing through OpenRouter is used only where zero-data-retention routing is enforced); and

(d) Nace is responsible for configuring its systems, processing routes and Subprocessors to meet this Section before Zero Retention requests are processed. An incorrect configuration does not excuse non-compliance.

Operational Metadata needed for billing, authorization, security and idempotency is still retained under Section 4.8 and may remain linked to the Account or organization. Saved schemas and classification domains remain saved configuration under Section 4.2. Zero Retention does not delete objects in Customer-Managed Storage.

**4.4** What deletion covers. Deletion under this Section covers all Customer Content Nace or its Subprocessors keep to provide the Services, including uploaded files, Outputs, temporary processing files, converted documents, page images, caches, embeddings and indexes, and webhook event payloads that contain Customer Content. Nace applies deletion to pending and running jobs so that they do not restore deleted Customer Content. Copies in Customer-Managed Storage are governed by Section 4.2.

**4.5** Deletion requests. Customer may delete Customer Content through the deletion controls in the Services or by contacting [support@nace.ai](mailto:support@nace.ai). Nace removes the requested Nace-held Customer Content from active systems within 72 hours. Deletion is processed asynchronously and completes within that period. A deletion request never extends an earlier deletion deadline.

**4.6** Backups. Residual copies in backups Nace controls are permanently removed within 35 days after removal from active systems. Until then they remain protected under this DPA, are not used for any other purpose, and, if restored for disaster recovery, are deleted again in line with this Section. Backups of Customer-Managed Storage are controlled by Customer.

**4.7** Deletion means deletion. Where this DPA or the Agreement requires Customer Content to be deleted, Nace will delete it. Removing identifiers from, de-identifying, anonymising, aggregating or re-labelling Customer Content does not satisfy a deletion obligation.

**4.8** Records Nace may keep. Nace may keep Operational Metadata and account and billing records only as reasonably necessary to operate, bill, support and secure the Services or as required by law, for the periods stated in the Privacy Notice (currently: API logs and usage metadata with user and API-key identifiers for up to 13 months, after which those identifiers are removed; account information up to 24 months after the Account is closed, with direct identifiers such as name and email address removed from most records when the Account is deleted; billing records for at least as long as tax and accounting laws require (typically 7 years after the Account is closed), and afterwards only with direct identifiers removed; a deletion record of a protected one-way fingerprint of the file name, the file size and page count, with no document content, for at least 7 years; one-way hashes of the email address and payment card fingerprint used at sign-up, to prevent repeated free-tier sign-ups; the IP address or network used at sign-up, for 30 days, for the same purpose; a content-free outline of each request (field names and counts, without values) and Customer-supplied request reference codes, as Operational Metadata; and a record of Customer's acceptance of the Terms, Privacy Notice and this DPA (each document's version, identified by its publication date, and the date of acceptance), each for as long as needed for that purpose). These records may include opaque operation, Account, organization, API-key and idempotency identifiers; removing direct user attribution does not make them anonymous. They must not contain Customer Content, including document text, prompts, results, original file names or content-bearing free-form errors. The 13-month period does not apply to Customer Content, which is kept and deleted under Sections 4.1 to 4.6. Section 4.7 continues to apply to Customer Content, which is always deleted.

**4.9** Legal requirements. If binding law requires Nace to keep specific Customer Data that would otherwise be deleted, Nace will keep only that data, only for the period required, use it only for that requirement, and delete it when the requirement ends. Nace will tell Customer about the requirement unless the law prohibits it. This Section does not permit routine retention of Customer Content for debugging, security monitoring or business convenience.

## 5. No training on Customer Content

**5.1** Nace will not use Customer Content to train, fine-tune, evaluate or improve general-purpose or shared models, or to create training or evaluation datasets, and will require its Subprocessors not to do so. This applies to all Accounts, including Free Tier Accounts, Paid Accounts and playground use.

**5.2** This restriction also applies to copies and derivatives of Customer Content, including anonymised, de-identified, aggregated or synthetic material derived from it. Re-labelling Customer Content as metadata, feedback or de-identified data does not remove the restriction. An account setting cannot authorise a use that this Section prohibits.

**5.3** The only exception is use that Customer separately and expressly authorises in writing (including through an opt-in control in the Console). Any authorisation must identify the Customer Content covered, the permitted purposes, the retention period and how Customer can withdraw it. Accepting the Agreement, using free credits or submitting Feedback is not authorisation. Customer-specific model development requested under a Separate Agreement is governed by that agreement.

**5.4** Nace may use Operational Metadata to operate and improve the Services. Operational Metadata does not include the contents of Inputs or Outputs.

## 6. Location of processing and confidentiality

**6.1** Nace is based in the United States. Customer Data is processed and stored in the United States and in the other countries where the Subprocessors listed in Schedule 2 operate, as stated in that Schedule. Where Applicable Data Protection Law requires safeguards for transfers of personal data between countries, Nace will put them in place.

**6.2** Nace will treat Customer Content as Customer's confidential information, limit access to personnel who need it to provide the Services or meet obligations under this DPA, and bind those personnel to confidentiality obligations. If disclosure is legally compelled, Nace will disclose only what is required and, where legally permitted, give Customer advance notice and reasonable cooperation.

## 7. Subprocessors

**7.1** Customer authorises Nace to use the Subprocessors listed in Schedule 2 for the functions stated there. The current list is also published at [trust.nace.ai/subprocessors](https://trust.nace.ai/subprocessors).

**7.2** Nace will impose written obligations on each Subprocessor that protect Customer Data at least as effectively as the applicable obligations in this DPA, including confidentiality, security, the no-training restriction, and retention terms compatible with Section 4. Subprocessors may receive only the Customer Data needed for their stated function. Nace remains responsible to Customer for its Subprocessors' performance of those obligations. General third-party disclaimers in the Agreement do not relieve Nace of this responsibility.

**7.3** Nace will give notice of any new or replacement Subprocessor by updating the list at [trust.nace.ai/subprocessors](https://trust.nace.ai/subprocessors) before the Subprocessor begins processing Customer Data and by email to Account owners who have subscribed to updates. If Customer does not agree to a change, Customer may stop using the affected Services and close its Account.

## 8. Security and Security Incidents

**8.1** Nace will implement and maintain technical and organisational security measures appropriate to the nature of Customer Data and the risks of the processing, including those in Schedule 3. Nace will not materially reduce the overall protection provided by those measures during the term of the Agreement.

**8.2** Nace will notify Customer of a Security Incident affecting Customer Data without undue delay, and no later than 72 hours after becoming aware of it, by email to the Account owner's address (or the security contact in Schedule 1, if provided). The first notice may be preliminary. It will include what is known about the incident, the Customer Data affected, containment measures taken and a contact for further information. Nace will provide more information as it becomes available, take reasonable steps to contain and remediate the incident, and reasonably help Customer meet its own notification obligations. Notice will not be delayed while the investigation is completed. Notice of a Security Incident is not an admission of fault.

## 9. Assistance and verification

**9.1** Taking into account the nature of the processing and the information available to it, Nace will reasonably assist Customer (a) in responding to requests from individuals exercising their rights under Applicable Data Protection Law in relation to personal data in Customer Data, and (b) in demonstrating compliance with this DPA. If Nace receives such a request directly, it will refer the individual to Customer where it can identify Customer.

**9.2** On request, Nace will provide reasonable documentation of its compliance with this DPA, including security information and reports available through the Trust Center at [trust.nace.ai](https://trust.nace.ai) (such as its SOC 2 Type 2 report), subject to confidentiality.

**9.3** If that documentation does not reasonably address a substantiated compliance concern, the parties will agree a proportionate review by Customer or an independent reviewer, at Customer's cost, with reasonable notice, under confidentiality obligations and with measures that protect other customers' information and the availability of the Services. Nothing in this DPA requires Nace to restore or recreate Customer Content that was deleted under Section 4.

## 10. Duration and termination

**10.1** This DPA applies from the first processing of Customer Data and continues while Nace or its Subprocessors process Customer Data.

**10.2** When Customer's Account is closed or the Agreement ends, Nace will stop processing Customer Content except as needed to close the Account, and will delete Nace-held Customer Content in accordance with Section 4; Account closure and the end of the Agreement are deletion triggers in the same way as an explicit deletion request. Copies in Customer-Managed Storage remain under Customer's control. Customer Content is not held for a general export or return period after termination; Customer is responsible for keeping copies of Inputs and Outputs it needs. Records kept under Sections 4.8 or 4.9 remain protected by this DPA and are deleted when their permitted purpose ends.

**10.3** On reasonable request, Nace will confirm in writing that deletion has taken place, or identify the categories of any data kept and the reason under Section 4.8 or 4.9.

## 11. General terms

**11.1** Except as changed by this DPA, the Agreement remains in effect, including its governing law, dispute resolution and limitation of liability terms. General warranty disclaimers in the Agreement do not cancel the express obligations in this DPA. Nothing in this DPA limits rights or obligations that cannot lawfully be limited.

**11.2** Nace may update the published version of this DPA. Material changes will be notified in advance as described in the Terms of Service and take effect on the date stated in the notice; before that date, Customer may delete Customer Content or close its Account. A countersigned copy can be amended only in writing signed by authorised representatives of both parties.

**11.3** This DPA may be accepted electronically and, where countersigned, signed in counterparts. Nace's contact for notices, privacy requests and security matters is [support@nace.ai](mailto:support@nace.ai).

## Schedule 1: Details of processing

| Item | Details |
| --- | --- |
| Services covered | All Services under the Agreement: Perception models (parse, split, classify, extract, ground), Decision models including Drex, and every Access Method (Console, APIs, CLI, SDKs, MCP Server, interactive playgrounds). |
| Nature and purpose of processing | Receiving Customer Content, processing it with Nace models (and, where listed in Schedule 2, Subprocessor infrastructure and model inference), returning Outputs, storing Customer Content under the retention mode Customer selects (Standard or Zero Retention) until Customer's deletion instruction or Account or workspace closure, billing, support and security. |
| Types of Customer Content | Business documents and data submitted by Customer (for example invoices, financial statements, bank statements, contracts, audit evidence, forms and spreadsheets), questions and state information for Decision models, and the resulting Outputs. |
| Categories of personal data | Personal data incidentally contained in Customer Content, such as names, contact details, postal addresses, job titles, signatures, account numbers and tax identifiers. Account and billing data of Customer's users (name, email, organisation, role). Prohibited Data must not be submitted. |
| Categories of individuals | Customer's employees and users; Customer's clients, suppliers, counterparties and their personnel whose details appear in documents. |
| Duration | For the term of the Agreement; Customer Content is retained as set out in Section 4. |
| Retention summary | Standard: until deleted, or until Account or workspace closure (no automatic expiry). Zero Retention: Nace-held temporary copies within 1 hour (workbench content may remain in Nace backups up to 35 days). Deletion requests: 72 hours. Nace-controlled backups: 35 days after active deletion. Customer-Managed Storage: controlled by Customer. Expiry of a download link or token is not deletion. |
| Customer contacts (optional) | Notices: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ · Security incidents: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ |
| Nace contact | [support@nace.ai](mailto:support@nace.ai) |

### Signature block (only for a countersigned copy on request)

| Nace.AI, Inc. | Customer |
| --- | --- |
| Signature: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ | Legal name: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ |
| Name and title: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ | Signature: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ |
| Date: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ | Name and title: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ |
|  | Date: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ |

## Schedule 2: Subprocessors

Current list of Subprocessors, also published at [trust.nace.ai/subprocessors](https://trust.nace.ai/subprocessors). Each receives only the data needed for its function, and all process Customer Data in the United States.

| Subprocessor | Function | Receives Customer Content? | Location |
| --- | --- | --- | --- |
| Amazon Web Services | Cloud hosting, storage, databases and processing for the Services | Yes | United States |
| Microsoft Azure | Cloud infrastructure and processing, including for workspaces bound to Customer's Azure Blob Storage | Yes | United States |
| Modal | Execution of Decision models (Drex) | Yes, transient | United States |
| Vercel | Console, API and website hosting and routing; web analytics and performance monitoring | Transient (routing only); content logging disabled | United States |
| Temporal Technologies (Temporal Cloud) | Workflow orchestration for document processing | Yes, encrypted payloads | United States |
| Anthropic | AI model inference (Decision model analysis; optional search model) | Yes, transient | United States |
| Fireworks AI | AI model inference for schema generation, and hosting for requests routed through OpenRouter. Signed data processing agreement. | Yes, transient | United States |
| DeepInfra | AI model hosting for requests routed through OpenRouter. Signed data processing agreement. | Yes, transient | United States |
| OpenRouter | Fallback AI model processing when a primary model is unavailable. Forwards requests only to DeepInfra and Fireworks AI. Signed agreement prohibiting training and disclosure. Used with Zero Retention only where zero-data-retention routing is enforced. | Yes, transient | United States |
| Arize | Tracing and monitoring of AI model calls | No (content masked) | United States |
| Sentry | Error monitoring | No (content scrubbed) | United States |
| Supabase | Account, authentication, usage and billing database; in Standard mode also stores Console requests, results and workbench data | Yes (Standard mode) | United States |
| Upstash | Short-lived rate-limit counters and transient hand-off of requests (up to 15 minutes) | Yes, transient (up to 15 minutes) | United States |
| PostHog | Product analytics in the Console (text inputs masked) | No | United States |
| Stripe | Payment processing and billing | No | United States |
| Slack Technologies, LLC | Internal operational alerts (for example failed jobs and overdue deletions); internal identifiers and error codes only | No | United States |
| Cursor (Anysphere, Inc.) | Software development tools used by Nace personnel | No | United States |
| Resend | Account and service emails | No | United States |
| Cloudflare (Turnstile) | Bot checks at sign-up and sign-in | No | United States |
| Google, GitHub (sign-in, if selected by the user) | User authentication | No | United States |
| Google (Gemini) | AI model inference (grounding) | Yes, transient | United States |
| OpenAI | AI model inference (optional search model) | Yes, transient | United States |
| Mistral AI | Document text recognition (OCR), if enabled | Yes, transient | United States |
| Datalab | Document text recognition (OCR), if enabled | Yes, transient | United States |
| Speech transcription provider (Whisper / diarization) | Audio transcription | Yes, transient | United States |
| Nace models (NaceDM / nacecloud) | Nace's own models | Yes, transient | United States |
| Zitadel | User authentication | No (email address only) | United States |
| Mailjet | Account and service emails | No (email address only) | United States |
| Apryse | Document rendering licence check and fonts | No | United States |

Customer-Managed Storage (Customer's own Amazon S3 or Azure Blob Storage) is controlled by Customer and is not a Nace Subprocessor.

## Schedule 3: Security measures

Nace maintains the following measures for the Services.

| Area | Measure |
| --- | --- |
| Encryption in transit | All network traffic to and within the Services is encrypted (TLS), including database and cache connections. |
| Encryption at rest | File storage, caches, databases and workflow payloads are encrypted at rest. |
| Credentials | Customer API keys are stored only as hashes; only a short prefix is displayed. Sign-in uses one-time email codes or third-party sign-in; Nace does not store user passwords. |
| Access control | Access to production systems is limited to authorised personnel who operate the Services, protected by strong authentication and reviewed periodically. |
| Content in logs and telemetry | Error monitoring and model-call tracing are configured to mask or scrub Customer Content; product analytics masks text inputs. Operational Metadata excludes Customer Content. |
| Retention and deletion | Deletion in line with Section 4: Standard content kept until deletion or closure; explicit and closure deletion within 72 hours, including caches and converted documents; Zero Retention clean-up of Nace-held copies within 1 hour; Nace-controlled backups expire within 35 days. |
| AI model providers | Model providers that receive Customer Content are bound by signed agreements prohibiting training and retention, and a technical control ensures requests are sent only to those providers. |
| Assurance | SOC 2 Type 2 report and penetration test report covering the Services, available through the Trust Center under confidentiality. |
| Incident response | Security Incident notification within 72 hours as set out in Section 8.2, supported by a documented incident-response procedure and on-call arrangements. |

## For agents

- [Drex API guide](https://nace.ai/drex.md): the decision model: request shape, question types, benchmarks and deployment, as markdown
- [Decision endpoint](https://console.nace.ai/v1/systemone): POST with model "drex-latest", a state string and typed questions (choice, noul, score); https://console.nace.ai/v1/models lists checkpoints
- [Document endpoints](https://console.nace.ai/v1/documents/{parse|split|classify|extract|ground}): POST a source (a public URL, an uploaded workspace file or a finished parse job) and poll GET https://console.nace.ai/v1/documents/jobs/{id}; the same key and credit as decisions
- [Console](https://console.nace.ai): API keys, the playground, usage and billing; send `Authorization: Bearer $NACE_API_KEY` on every request
- [Console docs](https://console.nace.ai/docs): quickstart, question types, the document routes, errors, limits and pricing
- [Nace Document Intelligence](https://nace.ai/perception.md): the Perception series: parse, split, classify, extract and ground any file type with a location on every value
- [Drex for Search](https://nace.ai/drex/search.md): Drex for Search: decision-powered retrieval for agents, Drex finds the page, cited search through the CLI, SDKs, MCP and REST, and the public benchmark ranks
- [Use cases](https://nace.ai/use-cases.md): every Drex use case with its proof figures: browser use and search for developers, enterprise finance teams and professional firms
- [Developers](https://nace.ai/developers.md): The execution layer for agents: Perception, Decision and Search behind one key, the Drex Max frontier, install steps, a scripted agent session and the four deployment boundaries
- [Site index](https://nace.ai/llms.txt): every page on nace.ai; append `.md` to any page URL or send `Accept: text/markdown` for the markdown version