Built to be checked, not to be believed.

Every control below is described mechanically enough that someone technical can hold us to it: what runs under whose session, where the data physically sits, and what is logged. Where a control is enforced differently from the others, it says so in the same list as everything else, rather than in a footnote.

The counter records that standard: a control is stated once it can be checked against the running system, and it stays under review until it can. The count moves when the system does, in either direction.

7 stated0 under review

Writes
Every write runs under the caller’s own session. Nova prepares a change, signs it and hands it back unexecuted; the database sees the account that confirmed it, not a service identity.
Reads
Nova reads under a service identity, so every query it makes names the organisation it is allowed to read. That constraint is written into the query itself rather than inherited from the session. It is one of several layers separating one company’s data from another’s, and it is enforced differently from the rest, which is why it is named here rather than folded in with them.
Consent
Nova’s access to a workspace is a per-user setting, and it is opt-out — a person switches it off for themselves rather than a company switching it on for everyone. We say so plainly because the opposite reads better and is not true.
Role scoping
Two parts of this are enforced in code and one is not. Every write Nova proposes is checked against a minimum role before you are asked to confirm it, and financial figures — revenue, margin, invoices — are refused outright below manager. The rest of Nova’s read scoping is an instruction to the model, and an instruction is not a boundary. We would rather you knew which is which.
Tool ceiling
Five turns, five calls to a turn — a limit compiled into the runtime rather than a guideline. Every call is logged with its arguments and its result.
Practice
Built to OWASP practice and audited against it. The audit returned four findings; we say so here rather than leave the number out.
Location
Customer data is stored and processed in the EU. The database, authentication, file storage and edge functions run in Stockholm; the region is named in our sub-processor list along with every other party that touches the data. Static delivery of this website runs over a global CDN, billing runs through Stripe, and a request to Nova reaches our model provider, currently OpenAI or Google, through the Lovable AI Gateway — each under standard contractual clauses where a transfer leaves the EU.

What we do not have

SOC 2 Type II: Not held.
ISO/IEC 27001: Not held.
Penetration test, third party: Not yet commissioned.
Security questionnaire, completed: On request.

Certifications cost money and calendar time, and at our size both have gone into the product and into the controls above. When that changes this page changes with it. In the meantime the data processing agreement, the service level agreement and the full sub-processor list are published as signed — which is what a security review actually asks for first.

A security claim you cannot describe mechanically is a marketing claim. Everything above is written so you can hold us to it.