Is my data secure?
Both modes encrypt your documents in transit and at rest and never train on them.
FAQ
Who can read your customs data
Your customs records show your suppliers, your prices and your customers. Sealed and Standard protect different things, and we say which.
- Filed by a licensed broker†
- Published fees, charged after CBP pays
- Sealed on AMD SEV-SNP
11 questions
Read the full answer
Who can see my information?
You and your broker can; whether anyone at NexQloud can depends on the mode you choose.
Is my data used to train AI models?
No. Your documents are never used to train any model, in either mode.
The detail
In Sealed mode, we also publish the model's weights hash, so the model that ran can be checked against the one we name.
In Standard mode, an outside AI provider may process your documents, only on terms that bar training, so the promise rests on the provider's terms as well as ours.
Which AI model reads my documents?
An open-weight model running on NexQloud infrastructure; in Sealed mode it runs inside the confidential VM.
The detail
In Standard mode, an outside AI provider may process your documents, only on terms that bar training.
The arithmetic in a claim is done by ordinary code, not by the model.
Where is my data processed and stored?
In the United States, in both modes.
Sealed mode runs on NexQloud Sealed, in AMD SEV-SNP confidential VMs; Standard mode runs in the NexQloud cloud, plus an outside AI provider if one is used.
How long do you keep my documents?
In Sealed mode, the working copy is cryptographically erased at the end of each run, and a signed receipt is kept.
The detail
In Standard mode, for the engagement; then we delete them on schedule. In both modes, we keep claim totals, receipts and billing records.
You and your broker keep the records CBP requires, for three years after each claim liquidates.
- 19 CFR 190.15[1]
How can I tell a tariff refund scam from a real provider?
Check who files, where the money goes and what they ask for; CBP's May 2026 fraud bulletin names the warning signs.[2]
Is NexQloud Drawback SOC 2 certified?
Our SOC 2 status is SOC 2 Type 2. The report is available under NDA on request.
The detail
The security and trust center lists it with our subprocessors and vulnerability-disclosure policy.
A SOC 2 report and Sealed answer different questions: one audits controls, and the other limits who can read your documents.
Should I upload drawings, specifications or CUI?
No. Keep CUI-marked files, drawings, specifications and export-controlled technical data (ITAR or EAR) out of your upload, in either mode.
What happens if there is a data breach?
We notify your broker in time for its own report to CBP, and we notify you.
The detail
Brokers must report a breach to CBP within 72 hours, whatever their software vendor does. Our data agreement sets our notice period.
Our incident-response plan and disclosure policy are on the security page.
How do you protect against malicious content hidden in documents?
We treat every document as untrusted input.
The agent's output is held to fixed fields, it has no tools that send data out, and a licensed broker decides every line before filing.
The detail
In Sealed mode, outbound traffic is blocked except to you and your broker.
These are engineering practices, not immunity: hidden instructions in files are a known risk for AI systems.
- OWASP, LLM01 prompt injection, 2025[5]
Editorial
Sources and changes
Written by the NexQloud Drawback team from the primary sources linked on this page.
Change log
- First published.
Not legal advice. NexQloud Drawback is not a government agency.
NexQloud Drawback is software used by licensed customs brokers.
Get started
Read less. Run the demo.
Run the demo on a sample file. About three minutes.
-
01
Upload one quarter.
Entry summaries, invoices and export records.
WhoYou
-
02
AI drafts your claim.
It ties each export to its import, to the cent.
WhoThe agent
-
03
Your broker files. CBP pays you.
The refund goes directly to your bank account.
WhoA licensed broker
Your email and name open the demo. We never ask for your ACE login or bank details.
Ready now? Start a claimIEEPA refunds
Got your IEEPA refund? Drawback is the one that repeats.
We check every entry for CAPE first, the order CBP recommends.[6] Drawback can recur every year.
Which tariffs qualify?
For partners
Be the firm that finds your clients a second refund.
Brokers earn the drawback fee. CPA firms bill their own work. Refund firms keep their CAPE clients. Design partners help shape it before launch.
Apply to partner
No fee to apply. We reply within 2 business days.
What is duty drawback?
A refund of up to 99% of the duties, taxes and fees you paid on imports that you later export or destroy, or that went into products you export.[10] It works in any industry.
When can I start?
We open to importers in waves, in the order of the waitlist. The demo shows the whole product with sample data today, and partners can apply now.
What will you need from me?
One quarter of records to start: entry summaries, invoices, packing lists, shipping documents, and export, return or destruction records.
How long until CBP pays?
With accelerated payment, CBP can pay before the claim is final. Its only published timing, from December 2018: processing "will generally take place within 3 weeks of the claim resubmission date."[11]
Can I use my own customs broker?
Yes. Invite your own broker, or use one we name before you sign. Your POA stays with your broker, and your broker sets its own fee.
What if CBP pays less than claimed?
The fee follows what CBP actually pays. If CBP later recovers part of a payment, the fee is reduced to match.
Do you file CAPE claims?
No. We check every entry for CAPE first and flag what belongs there. You or your broker files CAPE. Refund firms work through one of you.