What Nova does #

• Passwords are stored only as salted one-way hashes (scrypt). Nova cannot read your password and will never ask you for it.
• Sign-in sessions use signed tokens. Signing out ends the session on the server, and you can sign out your other sessions from your account.
• Support ticket IDs are random. Opening a ticket needs both the ticket ID and the email address it was sent with.
• Profile pictures are checked by their actual file contents, and only small PNG, JPEG or WebP images are accepted.
• Sign-in and password-related requests are rate limited.
• API keys you enter in Atlas are stored in Windows Credential Manager on your computer, and are read by Atlas’s native side rather than by its web interface.
• The Nova websites load no third-party scripts.

What Nova does not claim #

No system is free of risk. Nova cannot promise that any product or service is safe from every problem, and it has no independent security audit to point to.

Files on your own computer are protected only as well as your computer is. Anything you send to a third-party service is subject to that service’s security.

Reporting a security problem #

If you find a security problem, write to getnovasupport@gmail.com with what you found and how to reproduce it. Please do not put it in a public place first, and do not access other people’s data to demonstrate it.

Nova cannot promise a response time.