Nouna is operated by NURSOL + CO LTD ("NURSOL", "we", "us"), which is responsible for the controls described on this page.
Authentication and authorization
Signed-in requests use a managed authentication service. Product data is protected with database row-level policies, and server functions authenticate user or internal service requests before protected work.
Connected-account credentials
OAuth credentials are handled by server-side integrations. Stored provider tokens are encrypted by the application before persistence; they are not rendered in customer-facing pages.
Workspace boundaries
Data access is designed to resolve through the signed-in user, workspace or brand, and connected account. Founder supervision remains required during beta, especially when selecting a destination account.
External requests
Server functions use restricted cross-origin rules, request authentication, rate limiting, and signature checks for supported webhooks. Provider outages and ambiguous timeouts are still operational risks.
What you control
- Use an individual account and protect your sign-in method.
- Connect only the provider accounts that belong to the selected brand.
- Review the exact brand, channel, destination account, and action before approval.
- Disconnect expired or unnecessary integrations and revoke provider access when appropriate.
- Do not place passwords, API keys, payment-card data, or unrelated personal data in prompts or uploads.
Reporting a security concern
Send a concise report to security@nouna.io. Include the affected URL, time, and steps to reproduce. Do not include live credentials or access tokens in email.