Skip to content
Nuntius

Security and compliance

Data responsibility

View as Markdown

The data you manage in Nuntius — leads, contacts, conversation messages, appointments, tickets — is personal data belonging to your own end customers. Moving it into a system of yours, whether with your API key (/public/v1), your own MCP server, or an integration connected from Integrations, doesn’t change the responsibility split that already governs the rest of Nuntius — it’s the same in all three cases:

  • Nuntius acts as the data processor: we process and store that data on your behalf, under the guarantees of your contract and our data processing agreement (DPA).
  • Your account (the tenant) is the data controller: you decide which external systems that data is shared with and for what purpose, and you’re the one who answers to your end customers and to the relevant data protection authority.

What this means in practice

Section titled “What this means in practice”

When your data leaves Nuntius into another system of yours (a CRM, a spreadsheet, your own helpdesk…), that destination system is outside what Nuntius can guarantee or audit. You’re responsible for:

  • Minimizing what you extract — request only the fields your integration actually needs, don’t list entire resources “just in case”.
  • Meeting your own information obligations (GDPR Arts. 13/14) about how you process that data in the destination system, if it adds a purpose your end customer wasn’t already told about.
  • Honoring an erasure request in your destination system too: deleting an end customer’s data in Nuntius (from the Platform) doesn’t automatically delete a copy already synced elsewhere before.
  • Safeguarding your API key or your MCP server’s credentials like any other credential that grants access to personal data — revoke them immediately if you suspect they leaked (guide API keys, section 13).

This page describes a split that’s already in force, not something new introduced by any one piece — it’s the same logic that already applies to any third-party integration connected from your account, whether or not a public API or MCP server is involved.

See also

Section titled “See also”