Security
Financial data deserves more than a privacy page
NanoFora holds ledgers, statements and forecasts. The controls below are structural, not policies we intend to add later.
Row-level tenant isolation
Every table carries a company reference and is protected by database policies. A query issued for one company physically cannot return another company's rows, regardless of application behaviour.
Role-based access control
Eight roles — owner, admin, CFO, accountant, analyst, manager, employee and viewer — map to an explicit permission matrix that is checked server-side on every action.
Authentication
Email and password with confirmation, plus Google sign-in. Sessions are short-lived and refreshed, and privileged operations re-verify the caller's role.
Document storage
Uploaded documents live in per-company storage paths with access mediated by the same policy layer that governs database access.
Immutable audit trail
Creation, modification, access and deletion events are logged with actor, target and timestamp. Log entries cannot be edited by application users.
Encryption
Data is encrypted in transit with TLS and at rest by the underlying managed infrastructure.
AI safety
How the AI is constrained
The AI never sees another company's data
Every model request is scoped to the requesting company's records. There is no shared context between tenants and your data is not used to train shared models.
Numbers are computed, not generated
Core financial metrics use deterministic queries and formulas. AI explanations and estimates can contain errors; review the underlying records and assumptions before relying on them.
Uncertainty is stated, not hidden
Where data is incomplete or an extraction is low-confidence, NanoFora reports the limitation rather than presenting a confident-looking guess.
Review the available evidence
Supported analyses include evidence links to relevant transactions or documents so you can review the records behind the result. Missing data can limit evidence coverage.
Reporting a vulnerability
If you believe you have found a security issue, contact us before disclosing it publicly. We acknowledge reports within two business days and will keep you updated until the issue is resolved. We do not pursue legal action against researchers who report in good faith and avoid accessing other customers' data.
security@nanofora.com