Security
Ask for evidence, not badges.
Security depends on the deployed system and its operating procedures. The following describes Nohm’s design priorities and the evidence to request before onboarding.
01
Identity and access
Confirm the identity provider, authentication requirements, account lifecycle and access review process for your environment. Signing in and being authorised to use a feature are different checks.
Roles should limit access to the relevant assistants, products and project data. Default-deny behaviour and revoked-access tests should be demonstrated rather than assumed.
02
Data separation
Agree the deployment boundary for your organisation and how models, runs, documents and retrieval indexes are separated.
Ask for isolation-test evidence before relying on multi-tenant arrangements. Public-site demonstrations are not proof of production isolation.
03
Providers, secrets and processing
Request the actual model-provider list, data regions and retention terms. Confirm how credentials are stored, rotated and revoked.
Do not infer training exclusions, residency guarantees or encryption coverage from marketing language; these need supporting configuration and contractual evidence.
04
Operational readiness
Backups need a restore test. Monitoring needs owners and escalation routes. Vulnerability management needs a documented response process.
Confirm logging, incident handling, recovery objectives and maintenance arrangements in the service agreement.
05
Assurance status
This site does not claim SOC 2 certification, ISO 27001 certification or a completed penetration test. Ask for any available assessments with their date, scope and unresolved findings.
Hosted solves and broader access remain subject to licensing and readiness checks.
06
Responsible disclosure
Send a concise report to info@terajouleenergy.com with “Security report” in the subject. Include the affected URL, observed behaviour and minimal safe reproduction steps.
Avoid accessing another user’s data, destructive tests or public disclosure of exploitable details. Stop if sensitive information appears. Do not send secrets in email. This page does not grant testing authorisation or promise a bounty.
Have a question about security?
Contact the team ↗