Security
How NowHum protects your account and what you save, who can reach it, and what we do if something goes wrong.
Information security
NowHum's founder is the security and privacy lead. Security questions and reports go to admin@nowhum.com.
- The tokens that let NowHum read the X, Instagram and TikTok accounts you connect are encrypted in a sealed token vault before they're stored, and its keys can be rotated.
- Service keys and tokens are held as Cloudflare secrets and read by the running service. They're kept out of NowHum's code.
- The direct messages you send NowHum, and the private copies of the photos and videos in them, are encrypted before they're stored. A note you send with a post is kept with that post in your library.
- Logs and alerts record what happened, not what you saved or sent: sign-in codes, tokens and email addresses are redacted, and alerts carry categories and counts.
- CI audits NowHum's production dependencies for known vulnerabilities.
- A production release first passes a preflight check and a smoke test on staging, and an automatic watch rolls it back if its health checks fail after release.
Access control
- You sign in through WorkOS, with a one-time code sent to your email or, where the sign-in page offers it, with Google. Sign-in attempts are rate-limited.
- Every server route states the sign-in it needs, and CI fails a route that doesn't. Sensitive actions, like deleting your account, ask for a recent sign-in.
- AI apps you connect act only with the permissions you approve, and you can change them or disconnect the app at any time.
- Operator tools that change stored data are staging-only or need an explicit production flag.
- You can delete your account and ask us to delete your data, as the Data deletion page describes.
Incident response
When we suspect a security incident, we:
- Detect: automatic alerts flag failed or stuck replies, unusual errors and spending over budget.
- Contain: switch the affected feature off, roll the release back, and revoke or rotate the affected tokens and keys.
- Assess: work out what happened, which data and which people it touched, and fix the cause.
- Notify: tell the affected people, and the platforms whose data is involved, without undue delay, and within 72 hours where the law requires.
- Record and review: write down what happened and what we changed, and review it to prevent a repeat.
To report a vulnerability or a suspected incident, email admin@nowhum.com. Our contact details for security researchers are also at /.well-known/security.txt.