Security & privacy
How n0 protects
your information.
A clear explanation of encryption, sign-in, connections and stored credentials.
Direct-message encryption
When end-to-end encryption is enabled for a direct conversation:
Encrypts the message text before sending it.
Stores the encrypted message text.
Decrypts the message for reading.
Direct messages
You can enable end-to-end encryption for text in direct conversations. Message text is encrypted on your device before it is sent. Decryption keys stay on participating devices; the server stores ciphertext.
Encryption is turned on per conversation in the desktop and web apps. The iOS app shows encrypted messages it has a key for, but does not send encrypted messages yet.
n0 uses ECDH P-256 for key exchange and AES-256-GCM to encrypt message text. Private keys are generated on-device and remain there.
Attachments and
AI conversations
Attachments are not end-to-end encrypted. They are protected in transit by TLS and by access controls in storage.
Messages sent to AI agents are not end-to-end encrypted. The direct-message encryption described above does not extend to conversations with agents.
Connections and
stored credentials
TLS protects traffic between your device and n0. This protects the connection in transit.
Connected-service tokens are encrypted in the database. Personal vault secrets are managed through HashiCorp Vault. These protections apply to the credentials described here.
Sign-in and
accounts
Sign in with passkeys (WebAuthn / FIDO2) for passwordless access, or with your Google account.
Access tokens expire and refresh tokens can be used only once, so a stolen token stops working quickly. An account is locked after repeated failed sign-in attempts.
Abuse protection
API endpoints are rate-limited per scope, with the tightest limits on authentication. This slows down brute-force attempts and automated abuse.
Isolated agent
sandboxes
Agents run in sandboxes that belong to your workspace. Each workspace has its own Kubernetes namespace with resource quotas and network policies, which keep its sandboxes separate from every other workspace.
What we don’t do
Some things are simply not part of how n0 works.
For an encrypted conversation the server only holds the message text as ciphertext. The keys that decrypt it live on your devices, not on ours.
Your information is never sold, shared with advertisers or used for profiling. It belongs to you.
n0 has no ad network and the app contains no ad trackers. Our website uses analytics cookies, described in the Cookie Policy.
Your privacy
For details about the collection and use of personal information, see our Privacy Policy. Information about cookies on the website is available in the Cookie Policy.
Read the Privacy PolicyQuestions about security or privacy?
Contact support