Security practices

Accounts are authenticated through our managed auth service. Sessions are held by the browser and can be ended at any time by signing out.

Application data is scoped per account at the database layer, so records are only readable by the account that owns them and by our server-side workloads.

NovaServe API keys are shown once at creation and stored as a hash. We cannot recover the original value, so a lost key must be revoked and replaced.

Keys can be revoked from the API keys page, which takes effect for subsequent requests.

All model calls run on NovaServe's own provider credentials, held as server-side secrets and never exposed to the browser.

NovaServe does not accept user-supplied provider API keys. Requests that attempt to pass one are rejected by a server-side guard, so every call stays metered in credits.

Traffic to the web app and API is served over HTTPS, and calls from our servers to upstream model providers use the providers' HTTPS endpoints.

Every request writes a usage event and deducts credits atomically, so spend cannot exceed the balance on the account.

Requests are rejected once the balance is exhausted rather than being served on credit.

If you believe you have found a security issue, contact us through the contact page with steps to reproduce and give us a reasonable window to respond before disclosing it publicly.

Please avoid testing that degrades the service for other users or accesses data that is not yours.

We do not currently publish third-party audit reports or certifications. If your organisation needs specific documentation, contact us and we will tell you what we can provide today.