Novo Agents Security
Security measures for Novo Agents and how to report concerns.
Last updated: October 9, 2026
Last updated: October 9, 2026
Status: Prelaunch version.
We use technical and organizational measures designed to protect Novo Agents and Customer Data. No system is completely secure.
Our measures
- Data is encrypted in transit and at rest. Credentials you provide are also encrypted by the application and are not returned by the API.
- Customer Data is scoped to a workspace, and API keys are scoped to a single workspace.
- AI provider credentials stay in infrastructure Novo Industries manages and are not sent to environments you host.
- File and shell work Novo Industries manages runs in isolated sandboxes. You are responsible for the security and isolation of environments you host.
- Requests to registered result handlers and approval hooks are signed so you can verify they came from Novo Industries.
- We monitor the Service for errors and abuse.
Your responsibilities
Keep API keys secret, limit who can access your workspace, and secure the systems you connect.
Reporting
Report suspected vulnerabilities to security@novoindustries.co.