> ## Documentation Index
> Fetch the complete documentation index at: https://docs.novu.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Security and Compliance

> Novu security, compliance, and data residency: SOC 2, ISO 27001, HIPAA, GDPR, regional API endpoints, and account-to-region binding rules.

## How to Request SOC and ISO Reports

You can access our compliance reports and certifications directly from our Trust Center at [trust.novu.co](https://trust.novu.co). The Trust Center provides self-service access to:

* SOC 2 Type II report
* ISO 27001 certification
* HIPAA compliance documentation
* Security policies and procedures
* Live compliance controls status

Simply visit [trust.novu.co](https://trust.novu.co) to request and download any security documentation you need.

## Compliance Certifications

### SOC 2 Type II

Novu Cloud is SOC 2 Type II compliant. We have completed penetration tests, security training, evidence collection, and follow secure development lifecycle (SDL) practices. You can see live control updates on our [Trust Center](https://trust.novu.co/).

### ISO 27001

Novu Cloud is ISO 27001 compliant. We have completed both Stage 1 and Stage 2 audits and fully defined ISMS requirements. This includes:

* Creating comprehensive organization processes
* Defining organization risk assessment policies
* Building Incident Response & Disaster Recovery plans

### HIPAA

Novu Cloud is HIPAA compliant and we offer Business Associate Agreements (BAA) for customers who require them. This enables healthcare organizations and their partners to use Novu while maintaining compliance with healthcare data protection requirements.

### GDPR

Yes, Novu is fully GDPR compliant. You can see the complete compliance report on our [Trust Center](https://trust.novu.co/). Novu provides separate data residency options in both the EU and the US to support your compliance needs.

Novu Cloud customers can download our Data Processing Agreement (DPA) and Standard Contractual Clauses (SCC) template at [novu.co/dpa](https://novu.co/dpa).

## Data Residency

### Available Regions

Novu Cloud is available in the following regions:

| Region          | Location                |
| --------------- | ----------------------- |
| **US**          | Virginia, United States |
| **EU**          | Frankfurt, Germany      |
| **UK**          | United Kingdom          |
| **Singapore**   | Singapore               |
| **Australia**   | Australia               |
| **Japan**       | Japan                   |
| **South Korea** | South Korea             |

As part of our GDPR compliance, you can choose which region your data resides in when creating your account. Enterprise regions (UK, Singapore, Australia, Japan, South Korea) are available on enterprise plans.

### Region-specific endpoints

Each region has its own API and WebSocket hostnames. Use the pair that matches the region you selected at signup:

| Region           | API base URL                | WebSocket URL             |
| ---------------- | --------------------------- | ------------------------- |
| **US** (default) | `https://api.novu.co/v1`    | `wss://ws.novu.co`        |
| **EU**           | `https://eu.api.novu.co/v1` | `wss://eu.socket.novu.co` |

<Warning>
  API keys are bound to the region where the account was created. Pointing an SDK, Inbox component, or API client at a different region's endpoint with the same key results in `401 Unauthorized`. To move an existing account to another region, contact [sales@novu.co](mailto:sales@novu.co) — you cannot self-migrate by changing the base URL.
</Warning>

For Inbox setup, see [EU region configuration](/platform/inbox/setup-inbox#eu-region).

### Switching Regions

To maintain data residency integrity, we cannot copy or move data between data warehouses in different regions. If you need to switch regions, please contact us at [sales@novu.co](mailto:sales@novu.co) to discuss your options.

### Self-Hosted and Hybrid Options

* **Open Source**: You control where your data is stored
* **Novu Hybrid-Cloud**: We help you deploy within your selected network infrastructure

## Data Storage and Retention

By default, data is stored using the following retention periods:

| Data Type          | Free    | Pro     | Team    | Enterprise |
| ------------------ | ------- | ------- | ------- | ---------- |
| Activity Feed Logs | 24 hrs  | 7 days  | 90 days | Custom     |
| Inbox Messages     | 30 days | 90 days | 90 days | Custom     |
| Other Messages     | 30 days | 90 days | 90 days | Custom     |

If you need to delete specific data or information, reach out to us at [support@novu.co](mailto:support@novu.co).

## Regulatory and PII Concerns

We regularly work with large enterprises and are happy to provide guidance on various compliance requirements. Our compliance reports and certifications are available through our [Trust Center](https://trust.novu.co/) to help ease your security and legal team's review process.

If you have specific concerns about PII, you have several options:

* Use our **open source** version for full control
* Choose the **Novu Hybrid-Cloud** enterprise plan
* Download our [Data Processing Agreement (DPA)](https://novu.co/dpa) and Standard Contractual Clauses (SCC) template
* Contact us at [sales@novu.co](mailto:sales@novu.co), [support@novu.co](mailto:support@novu.co), or via [Discord](https://discord.novu.co)

## Reporting Security Vulnerabilities

We are committed to our users' data security and highly appreciate responsible disclosure of security vulnerabilities. To report a security issue:

* Submit a [GitHub security advisory](https://github.com/novuhq/novu/security/advisories/new)
* Email us at [security@novu.co](mailto:security@novu.co)