novo agents
start free

Data flow & containment

Novo runs the agent; your data plane stays under your control. This page is the canonical map of what runs where, what crosses the boundary, and what is retained. It is the working companion to the security overview.

What runs where

your app ──── one signed POST ────▶  novo cloud            ┌─ your adapters
   ▲                                 · agent loop          │  · http_workspace (fs/shell)
   │                                 · model calls         │  · result handlers
   └──── SSE stream (run output) ─── · managed tools   ────┤  · tool servers (MCP)
                                     · metering            │  · approval hooks
                                                           └─ all signed: Novo-Signature
  • The agent loop and every model call run in Novo's cloud. Provider API keys live only there; they never enter a workspace, managed or yours.
  • Tool calls are what cross. When the agent needs your infrastructure, Novo POSTs to endpoints you registered, each signed with HMAC-SHA-256 in the Novo-Signature header (verify with the SDK's verifyNovoSignature). See Adapters.
  • Run output streams to you over SSE and is yours to persist. Novo's own copy of thread continuation state is encrypted at rest and never exposed through public APIs.

Where each class of data goes

| Data | Where it goes | Retention | |---|---|---| | Prompts, run input, model output | Novo's workers for inference; streamed back to you | Encrypted thread state until you delete the thread | | Files you stage | Novo file storage, attached to runs by fileId | Retention-scoped; promote durable copies via your result handler | | Run artifacts (deliverables) | Retention-scoped handles with retentionExpiresAt; signed URLs expire within a day | Durable storage happens on your side | | Workspace files (managed) | Novo-managed workspace in US East (iad1) | You configure 1–30 days, then reaped | | Workspace files (remote) | Your infrastructure; Novo only sends signed tool calls | Yours entirely | | Your secrets | Encrypted at rest; decrypted only in the worker step that needs them; projected only where you granted | Never returned on read APIs | | GitHub credentials | Novo's worker only; each operation mints a short-lived App token, and workspace Git receives a scoped firewall header window | Never in shell, env, files, Git config, remotes, argv, logs, or tool output | | Usage/metering | Novo billing ledger (token counts, costs, resource kinds) | Provider identities never disclosed; modelLabel is generic |

Untrusted content stays fenced

Agents that browse and research ingest content an attacker can write. Novo wraps browser page text, web search/fetch results, and default HTTP/tool-server output as untrusted external content, kept separate from instructions. Your workspace files and registered repositories are customer-controlled context; marking a tool server's output trusted is an explicit registration decision, never a default.

Strict data handling (canonical definition)

dataHandling: 'strict', settable on an agent, thread, or run, requires verified zero-data-retention, no-training inference routes from providers based in the US or Europe (EU and UK), with matching gates for managed capabilities that receive customer data.

  • Route-verified, fail-closed. Eligibility is checked per route; if anything the run needs has no verified strict path, the run is rejected before inference with strict_data_handling_unavailable. There is no silent fallback.
  • Escalation-only. Strict propagates to every delegated subagent and cannot be relaxed downstream.
  • Scope-honest. Strict is a data-use guarantee (retention and training), not a residency guarantee; it does not claim regional processing.
  • Live availability is on the bands endpoint: each band reports whether strict routes exist today.

Capability specifics (e.g. what the strict browser disables) live in Capabilities.

Your controls

  • Delete a thread (DELETE /v1/threads/:id) to destroy its stored state.
  • Gate consequential tools with an approval hook before they execute.
  • Cap any run with budgetCents; it terminates with budget_exceeded before overspending.
  • Keep tools on your side with a remote workspace: filesystem and shell execute in your environment, and Novo only ever sends signed requests.

The binding subprocessor list, security policy, and privacy documents are maintained by Novo Industries legal and linked from the security overview.