Security at NomadReply

• All traffic to and from NomadReply AI is served exclusively over HTTPS/TLS.
• OAuth access tokens for connected channels (WhatsApp, Instagram, Facebook, Google Business, Shopify) are encrypted at rest using AES-256-GCM before being stored.
• Account passwords are never stored in plaintext — they are hashed with bcrypt.
• The underlying database is encrypted at rest by our infrastructure provider.

• User authentication is handled through Auth.js (NextAuth), with session cookies scoped and secured for production.
• The login form is protected against automated abuse by Cloudflare Turnstile.
• Access to a business's data is scoped by organization at the application layer — every request is filtered by the authenticated user's organization, and administrative actions require an elevated role.
• Sensitive endpoints (login, contact form, outbound API calls to connected platforms) are rate-limited to reduce abuse.

• A Content Security Policy (CSP) and standard security headers (X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy) are enforced on every response.
• Incoming webhooks from third-party platforms (e.g. Meta, Shopify) are verified using HMAC signature validation before being processed.
• Errors and exceptions are monitored in real time (Sentry) so issues affecting production can be detected and addressed quickly.

NomadReply AI runs on Vercel (application hosting and serverless functions), with a PostgreSQL database and a Redis-backed queue for asynchronous processing. Database backups and physical infrastructure security are managed by our underlying infrastructure providers.

When a business connects a third-party account (WhatsApp Business, Instagram, Facebook, Google Business Profile, Shopify, and — subject to platform approval — TikTok and TikTok Shop), access is granted exclusively through that platform's official OAuth flow. We never ask for or store a third-party password directly. Access can be revoked by the business at any time from the Channels section of the dashboard, which also revokes the corresponding token.

NomadReply AI does not currently hold formal third-party security certifications (such as SOC 2, ISO 27001, or a completed independent penetration test). We rely on the practices described above and will update this page if that changes.

If you believe you've found a security vulnerability in NomadReply AI, please report it to info@nomadreply.app with the subject line "Security report". Please include enough detail to reproduce the issue and avoid accessing or modifying data that isn't your own. We will acknowledge reports and work to address confirmed issues promptly.

A dedicated security@nomadreply.app address is planned but not yet configured — use the address above in the meantime.