Draft — review required
This page is a product-launch draft, not a final legal policy. It must be reviewed and approved by qualified counsel before production use.
Security Overview
Last updated July 22, 2026
Account security
NOMO uses server-managed sessions and built-in password hashing through Better Auth. Access checks occur on the server.
Data isolation
Every member query is scoped to the authenticated user identifier. Admin access requires authentication and a server-side email allowlist.
Private documents
Uploaded files use private object storage. Files are served only through an authenticated route after ownership or admin access is verified.
Operational readiness
Security review, incident response contacts, retention procedures, and production monitoring must be finalized before launch.