Security & data handling

The boundary

The product is built around one split. Novo owns the parts that make the agent run: model routing, encrypted per-thread session state, managed tool execution, and usage metering. You own the parts that are your product: the clean transcript, your files, your tool backends, and your UI. Run output streams to you and is yours to store; Novo's copies of thread state are encrypted and never exposed through public APIs.

Every callback is signed

When a run needs your infrastructure (a filesystem or shell tool in your environment, a deliverable posted to your result handler, a tool call reviewed by your approval hook), Novo calls an endpoint you registered, signed with HMAC-SHA-256 and a timestamp in the Novo-Signature header. The SDK ships verifyNovoSignature with typed failure reasons, and adapter secrets rotate without downtime. Nothing calls your systems unsigned. See signed callbacks for the verification contract.

Keys never cross the boundary

• Model-provider API keys never enter your environment, or any workspace, managed or yours. Model calls run in Novo's workers; tool calls are what cross, signed.
• GitHub credentials stay in Novo's worker. Workspace git operations receive a short-lived authorization header at the sandbox network edge only for the managed operation. The token never appears in the shell, environment, files, git config, remotes, or tool output. If Novo cannot prove the header was removed, it stops the workspace.
• Your secrets are encrypted at rest, decrypted only in the worker step that needs them, projected only to destinations you explicitly granted, and never returned on read APIs.

Outside content stays fenced

Agents that browse and research ingest content an attacker can write. Novo wraps browser page text, web search and fetch results, and default HTTP/tool-server output as untrusted external content, kept separate from instructions. First-party workspace files and your registered repositories are treated as customer-controlled context; marking an adapter's output trusted is an explicit registration decision, never a default.

Strict data handling

Set dataHandling: 'strict' on an agent, thread, or run and Novo requires verified zero-data-retention, no-training inference routes from providers based in the US or Europe (EU and UK), with matching gates for managed capabilities that receive customer data. Eligibility is checked per route: if no verified strict route exists for what the run needs, the run is rejected before inference with strict_data_handling_unavailable. It never silently falls back. Strict propagates to subagents and cannot be relaxed downstream. One honest limit: strict is a data-use guarantee. It does not claim where processing happens. Check live availability per band via GET /v1/bands.

Humans in the loop, budgets on the run

Consequential tool calls can be gated on your approval hook before they execute, and any run can carry a hard budgetCents cap that terminates it with budget_exceeded before it overspends. Runaway behavior has a ceiling you set.

Retention and deletion

• Threads are deletable via DELETE /v1/threads/:id: deletion destroys the thread's stored state.
• Artifacts are retention-scoped handles with an explicit retentionExpiresAt; temporary signed URLs expire within a day. Durable storage happens on your side, through your result handler.
• Managed workspaces retain files for a window you configure (1–30 days), then reap.

Infrastructure

Managed workspaces currently run in US East (iad1). Live platform status is published at the foot of every page on this site.