Security is central to how Crynetix Nova is built. This page summarises the practices we follow.
Authentication
Accounts are protected by managed authentication. Sessions are stored in secure browser storage and can be revoked at any time.
Data in transit
All traffic between your browser, our backend and third-party AI providers is protected using industry-standard TLS.
Secrets
API keys and provider credentials are stored server-side only and never exposed to the client, in analytics, in URLs or in logs.
Isolation
Backend endpoints validate the caller before performing privileged actions. Row-level policies scope conversation data to the owning account.
Responsible disclosure
If you believe you have found a security vulnerability, please email security@crynetix.com. Please do not publicly disclose issues before we've had a reasonable opportunity to investigate.