Four controls do most of the work: brand isolation, role-based access, an audit trail that covers agent actions, and consent enforced at the point of sending.
Each brand is provisioned as its own workspace with its own separated data store, branding, currency, timezone and team. Contacts, campaigns, content and analytics never mix between workspaces — which is what lets one agency run several client brands from a single login.
Permissions are set individually rather than in fixed bundles, so a contractor, an analyst, a client and an administrator each get exactly what the work requires. Roles are scoped per brand, and removing someone is immediate and complete.
Every action is recorded, including the actions an agent took rather than a person. That distinction matters more in a platform where software can publish, spend and message on your behalf — and it is the question that actually gets asked in a review.
A global unsubscribe blocks everything. Email, SMS and WhatsApp each require their own opt-in, checked at the point of sending. Skips are reported honestly as consent skipped rather than silently dropped, and the models return “wait” instead of recommending contact with someone who has not opted in.
Built into the tracking library rather than bought separately, and themed to match your brand.
Only what you switch on. Action tracking, heatmap tracking and session recording are three independent toggles.
Nommos does not currently hold ISO 27001 or SOC 2 certification, and we would rather state that plainly than imply otherwise on a badge. If your procurement process requires either, tell us early so we can be straight with you about timelines rather than about status.
Data hosting location and regional options, retention and deletion policy including session recordings, and whether customer data is used to train models — these depend on your contract and deployment, so we answer them in writing during procurement rather than generalising on a marketing page.
We would rather answer the specific questions your process asks than publish a page of reassurance.
