Security at Nua

Setup is a login, not an integration project. Nua's browser agent signs into your app with test credentials you create for it, and sees only what that account can see.

• No codebase access required. Connecting a repo is optional, and off by default.
• No production database access. Nua never connects to your infrastructure. It uses your app through the front door.
• You scope the account. Give Nua a test account in a staging environment and that is the entire blast radius.

• Run evidence. Screen recordings, screenshots, console output, and network logs from test runs. This is how bugs get found and reproduced.
• Test credentials. Encrypted at rest, used only by the agent to sign in.
• Context you connect. Docs and tickets from Linear, Notion, or GitHub. GitHub uses short-lived installation tokens; no long-lived GitHub credential is stored.

The full inventory is in the privacy policy.

• All traffic is encrypted in transit.
• Stored app credentials are encrypted at rest, separately from the rest of the database.
• Every record is scoped to your organization at the data model level. Cross-tenant access is a query that cannot be written, not a filter that can be forgotten.
• Sign-in is delegated to Auth0. We never see or store your password.
• Data lives on AWS in the United States.

Test runs are analyzed by AI models from Anthropic and OpenAI through their commercial APIs. Under those terms your data is not used to train their models. Nua's output is a fix prompt your team reviews; the agent never lands code changes on its own.

We are an early-stage company and do not yet hold formal certifications like SOC 2. We would rather tell you that plainly than imply otherwise. If your security review needs specific answers, ask us directly and you will get them from the founders.

Found something in Nua itself? Email hello@trynua.dev and a founder will respond quickly. We appreciate the report, and we will not take action against good-faith research.