Nebul
Nebul B.V. · NL · Last reviewed: 2026-07-28
Data Protection Contracts
83/100Nebul has a Data Processing Agreement (DPA v1.6) under Art. 28 GDPR.
jaSource: Nebul DPA v1.6, Vollständig geprüft und abgelegt 2026-07-24; DPA regelt Auftragsverarbeitung, deckt Prozessorkette (reviewed 2026-07-24)
Nebul contractually guarantees that personal data remains within the EU; SCC coverage for a few support tools with US parent companies is still to be confirmed.
teilweiseSource: Nebul DPA v1.6, §12.1 - 'all Customer Personal Data will remain within the EU' für die Kerninfrastruktur; SCC-Absicherung für einzelne Support-/CRM-Subprozessoren mit US-Mutterkonzern (HubSpot, Slack, Microsoft, Halo) noch zu bestätigen (reviewed 2026-07-24)
Nebul contractually commits to notifying security incidents within 72 hours.
jaSource: Nebul DPA v1.6 / Incident-Response-Process v4, §7.1.1 - 72 Stunden vertraglich zugesichert (reviewed 2026-07-24)
Data Residency & Sovereignty
100/100Nebul contractually guarantees processing exclusively within the EU (Amsterdam data center).
jaSource: Nebul DPA v1.6, §12.1 - EU-only-Verarbeitung vertraglich zugesichert; Rechenzentrum Amsterdam (Eurofiber) (reviewed 2026-07-24)
Nebul runs inference on its own hardware without sub-processors; the only sub-processors are EU-hosted support tools, with advance notice and an objection right.
jaSource: Nebul DPA v1.6, Schedule 4, Ausschließlich Support-/CRM-Tools als Sub-Prozessoren (HubSpot, Slack, Halo, Microsoft), alle EU-gehostet; keine Inferenz-Sub-Prozessoren (Inferenz läuft auf eigener Hardware); Änderungen mit 30 Tagen Vorlauf, 15 Tage Widerspruchsrecht (§13.3) (reviewed 2026-07-24)
Nebul is operated by Nebul B.V., a Dutch (EU-based) company headquartered in Leiden.
jaSource: Nebul Master Agreement / Handelsregisterangabe, Nebul B.V., Sylviusweg 74, 2333 BE Leiden, Niederlande, KvK 86737627 (reviewed 2026-07-24)
Data Use
100/100Nebul contractually processes requests only in memory during inference; memory is cleared between calls (zero data retention).
jaSource: Nebul DPA v1.6, §15.2 - 'Data exists in memory only during inference', Speicher wird zwischen Aufrufen geleert (No-Logging vertraglich) (reviewed 2026-07-24)
Nebul contractually does not use customer data, prompts, or outputs to train or fine-tune models.
jaSource: Nebul DPA v1.6, §15.1 - explizit kein Training/Retraining/Fine-Tuning auf Customer Data, Prompts (auch von End Usern) und Outputs; Ausnahmen nur per schriftlicher Vereinbarung (§15.3) (reviewed 2026-07-24)
No opt-out is needed at Nebul, since the training and logging prohibition applies unconditionally by default and can only be waived by separate written agreement.
jaSource: Nebul DPA v1.6, §15.3 - Ausnahmen vom Trainings-/Loggingverbot nur per schriftlicher Vereinbarung; kein Opt-out nötig, da Verbot standardmäßig unbedingt gilt (reviewed 2026-07-24)
Certifications
50/100Nebul contractually commits to ISO 27001; the specific certificate itself has not yet been obtained as supporting evidence.
teilweiseSource: Nebul DPA v1.6 / Drata-Zertifikatsauszüge, §8.3 - ISO 27001 vertraglich als Garantie zugesichert; das konkrete ISO-27001-Zertifikat (K-0222069) selbst liegt als PDF noch nicht vor (nur Querverweis aus anderen Zertifikaten), Beschaffung offen (reviewed 2026-07-27)
Nebul maintains a SOC 2 Type II report whose content has not yet been made available to us for review; no C5 attestation exists.
teilweiseSource: Nebul Drata-Portal, SOC 2 Type II Report im Drata-Portal gelistet, Zugriff jedoch gesperrt/noch nicht erhalten; kein C5-Testat vorhanden (reviewed 2026-07-27)
AI Act Readiness
n/aPure inference/hosting provider: the AI Act's Article 53 documentation duty falls on the provider of the GPAI model, not on whoever runs the inference. This provider cannot discharge it for third-party models; the duty sits with the respective model provider.
nicht_anwendbarSource: Verordnung (EU) 2024/1689 (KI-VO), Art. 53 Abs. 1 i. V. m. Art. 3 Nr. 3 – Pflichten des Anbieters eines GPAI-Modells (reviewed 2026-08-04)
Pure inference/hosting provider: the GPAI Code of Practice is open to providers of general-purpose AI models. A provider that merely operates third-party models is not eligible to sign, so an absent signature is not a shortcoming.
nicht_anwendbarSource: Verordnung (EU) 2024/1689 (KI-VO), Art. 53 Abs. 1 i. V. m. Art. 3 Nr. 3 – Pflichten des Anbieters eines GPAI-Modells (reviewed 2026-08-04)
Contract Quality & Transparency
33/100Nebul's contract documents (Master Agreement, AI Factory Terms) are publicly available, and contracting is done via self-service at studio.nebul.io.
jaSource: Nebul Master Agreement v1.6 / AI Factory Terms v1.0, Öffentlich abrufbare Vertragsdokumente, Self-Service-Vertragsabschluss über studio.nebul.io (reviewed 2026-07-24)
No verifiable commitment
unbelegtThe mutual cap of twelve months' fees matches the market standard, and intent and gross negligence are expressly uncapped. Two provisions offset this, however: liability for the value of customer data is expressly excluded, and the indemnification duty falls one-sidedly on the customer, sits outside the cap, and expressly covers customer data.
neinSource: Nebul Master Agreement v1.6 (abgelegt 24.07.2026), §10.1(B) — keine Haftung für 'the value of Customer Data'; §10.2 Damages Cap — beidseitig auf die in zwölf Monaten gezahlten Entgelte begrenzt, jedoch 'Except for payment obligations under Section 8'; §10.4 — keine Begrenzung bei Vorsatz und grober Fahrlässigkeit; §8.1 Indemnification — einseitige Freistellungspflicht des Kunden, ausdrücklich einschließlich §8.1.2 'Customer Data', außerhalb des Deckels. (reviewed 2026-08-24)
Do you represent Nebul and think something is inaccurate? Write to legal@kontinent.ai. We check every report and correct verified errors with full transparency.
Report error