Trust
Security & Compliance at Nevermined
Nevermined moves real money on behalf of AI agents, so the infrastructure is built to the standard banks and auditors expect: ISO 27001 certified, SOC 2 Type II audited, and PCI SAQ-D compliant, with card data tokenized at capture and never stored.
Opens our Trust Center: live compliance status, security documentation, and report requests under a non-disclosure agreement.
Certifications and attestations
Certified information security management system covering data residency, access controls, and incident response.
Independently audited for security, availability, and confidentiality over an extended observation period.
Card data is captured by Very Good Security, a PCI Level 1 card vault, and tokenized before it enters our systems. Nevermined never stores raw card numbers.
Under GDPR, the EU data protection law, personal data is minimized and encrypted, and deletion requests are honored within the required timeframes.
FIDO2, the open passkey login standard: phishing-resistant, hardware-bound passkeys for card enrollment and account access.
Security built for agents that buy on their own
Agent payments introduce risks that traditional payment security does not cover: software making purchasing decisions without a human at the keyboard. Nevermined's controls are designed for exactly that.
- A spend mandate for every agent. You set each mandate: an amount, a number of purchases and an expiry. The agent cannot spend past it.
- Revocable in one action. One action revokes an agent's mandate, with no grace period.
- Every transaction logged. Each transaction is logged with the agent, amount, merchant and time, and can be exported for SOC 2, ISO 27001 and regulatory audits.
- Verifiable identity. Each agent can carry a public identity record (ERC-8004, an open agent identity standard), and signature checks prove who sent a request.
Need our reports for a vendor review?
The SOC 2 Type II report, ISO 27001 certificate, and PCI attestation of compliance are available through the Trust Center under a non-disclosure agreement. For anything else, security questionnaires or architecture reviews, contact us.
trustcenter.nevermined.ai ↗