Security & data handling

The boundary

The product is built around one split. Novo owns the parts that make the agent run: model routing, encrypted per-thread session state, managed tool execution, and usage metering. You own the parts that are your product: the clean transcript, your files, your tool backends, and your UI. Run output streams to you and is yours to store; Novo's copies of thread state are encrypted and never exposed through public APIs.

Every callback is signed

When a run needs your infrastructure (a filesystem or shell tool in your environment, a deliverable posted to your result handler, a tool call reviewed by your approval hook), Novo calls an endpoint you registered, signed with HMAC-SHA-256 and a timestamp in the Novo-Signature header. The SDK ships verifyNovoSignature with typed failure reasons, and adapter secrets rotate without downtime. Nothing calls your systems unsigned. See signed callbacks for the verification contract.

Keys never cross the boundary

• Model-provider API keys never enter your environment, or any workspace, managed or yours. Model calls run in Novo Cloud; tool calls are what cross, signed.
• GitHub credentials stay in Novo's control plane. Workspace git operations receive a short-lived authorization header at the sandbox network edge only for the managed operation. The token never appears in the shell, environment, files, git config, remotes, or tool output. If Novo cannot prove the header was removed, it stops the workspace.
• Your secrets are encrypted at rest, decrypted only in the operation that needs them, projected only to destinations you explicitly granted, and never returned on read APIs.

Outside content stays fenced

Agents that browse and research ingest content an attacker can write. Novo wraps browser page text, web search and fetch results, and default HTTP/tool-server output as untrusted external content, kept separate from instructions. First-party workspace files and your registered repositories are treated as customer-controlled context; marking an adapter's output trusted is an explicit registration decision, never a default.

Data handling

Your data is never used to train models, on any plan. Novo carries that commitment two ways: gateway-routed inference sets a per-request no-training flag, and every provider Novo routes to is covered by no-training terms or an account-level no-training setting. AI inference routes to the subprocessors Novo discloses, and every provider in that set is a company under US, EU, or UK jurisdiction. This is a commitment about how your data is used. It does not claim where processing happens, and Novo makes no data-residency claim.

Humans in the loop, budgets on the run

Consequential tool calls can be gated on your approval hook before they execute, and any run can carry a budgetCents cap. Novo checks cost between model calls and stops at the first check past the cap with budget_exceeded. Work already in flight can land past the cap and remains billed; the terminal receipt reports the exact final cost.

Retention and deletion

• Threads are deletable via DELETE /v1/threads/:id: deletion destroys the thread's stored state.
• Artifacts are retention-scoped handles with an explicit retentionExpiresAt; temporary signed URLs expire within a day. Without a result handler, Novo stores managed artifact bytes until retention expiry. Configure a result handler to hand durable storage to your system.
• Managed workspaces retain files for a window you configure (1–30 days), then reap.

Infrastructure

Managed workspaces currently run in US East (iad1). Live platform status is published at the foot of every page on this site.