Skip to main content
    Nouna

    Security at Nouna.

    This overview describes controls visible in Nouna's current application architecture. It does not claim a certification, audit, or absolute protection that has not been established.

    Updated July 28, 2026

    Authentication and authorization

    Signed-in requests use Supabase authentication. Product data is protected with database row-level policies, and server functions authenticate user or internal service requests before protected work.

    Connected-account credentials

    OAuth credentials are handled by server-side integrations. Stored provider tokens are encrypted by the application before persistence; they are not rendered in customer-facing pages.

    Workspace boundaries

    Data access is designed to resolve through the signed-in user, workspace or brand, and connected account. Founder supervision remains required during beta, especially when selecting a destination account.

    External requests

    Server functions use restricted cross-origin rules, request authentication, rate limiting, and signature checks for supported webhooks. Provider outages and ambiguous timeouts are still operational risks.

    What you control

    • Use an individual account and protect your sign-in method.
    • Connect only the provider accounts that belong to the selected brand.
    • Review the exact brand, channel, destination account, and action before approval.
    • Disconnect expired or unnecessary integrations and revoke provider access when appropriate.
    • Do not place passwords, API keys, payment-card data, or unrelated personal data in prompts or uploads.

    Reporting a security concern

    Send a concise report to security@nouna.io. Include the affected URL, time, and steps to reproduce. Do not include live credentials or access tokens in email.