Trust, privacy and support.

How your data is handled.

Visibility is enforced on the server

Work outside your reach is not hidden in the browser — the API never sends it. There is no dimmed row to inspect and nothing to infer from a shape you can't open.

Passwords are hashed, never stored or emailed

Hashed with bcrypt at cost 12. Nobody at Novus can read your password, and no email we send ever contains one.

Reset links are single-use and hashed too

Only a SHA-256 hash of a reset link is stored, so a copy of the database is not a set of working links. Each link redeems exactly once, expires, and completing a reset signs out every other device on that account.

No tracking cookies — and a plain word about sessions

Novus sets no advertising or analytics cookies, which is why you have never been asked to dismiss a consent banner here. Your sign-in is a 30-day token in the browser's local storage — a plain mechanism, not a security feature. Moving it to an HttpOnly, Secure cookie is on the security roadmap.

No analytics or advertising SDKs

Neither the web app nor the API carries a product-analytics, session-replay or ad SDK. Your behaviour inside Novus is not a data set we sell, share or measure.

What reaches a model, exactly

A spreadsheet is never sent. Novus sends a bounded excerpt of it — at most the first 15 rows of up to 3 sheets, 14 columns wide, each cell cut to 40 characters. The one exception is a plain-text Read-me, which is sent as it is up to 16,000 characters. Everything else a model is told about your records is worked out in Novus first — totals, averages, spreads, rankings, and the names those figures belong to — so the analysis runs on your data here and the model sees the result.

Which model, what for, and whether it trains on your data

Novus AI, Guided, Plan AI and Talk to Novus run on Anthropic. Message screening for status suggestions runs on OpenAI. Neither company trains on data sent through its API — that is their published position for API traffic, and it is the reason both are among the most widely accepted sub-processors there are. Remove an API key and that feature switches off and sends nothing; the rest of the product carries on.

AI can be turned off, for a workspace or one project

Settings has an AI switch for the whole workspace, and each project has its own for its Owners. Off, nothing from that project is sent to any model — the check is on the server, before every call, not a hidden button. The engines, Studio, What-ifs, Review and the exports don't use a model and carry on as usual, and Guided still checks files, worked out in code. The project page says AI is off, and who turned it off and when is kept.

Encrypted in transit, and your chat messages encrypted at rest

Every connection to Novus is over TLS, and the database is managed Postgres on Neon, which encrypts its storage. Chat messages get one more layer: each body is stored as AES-256-GCM ciphertext under a key that lives in the server's environment and never in the database, so a dump, a backup or a query window holds text nobody can read. What that does not claim: the running server has to read a message to show it to your team, screen it, or answer a question about it, so whoever controls the server and its key could in principle decrypt. What it removes is everything short of that — and no Novus tool reads your messages; there is no operator route that can.

Your data is in the United States, and there is only one region

Records sit on Neon's managed Postgres in Northern Virginia, United States (AWS us-east-1), with the API beside it. You cannot pick a different region — there is one, and it is this one. For customers in the EU and UK, holding records there is a transfer out of Europe, made under the EU Standard Contractual Clauses and the UK Addendum in the draft DPA; the same terms cover the model providers, outbound email and edge hosting named below.

Thirty days after you close an account, it is gone

Your content stays recoverable for 30 days after an account closes — long enough to change your mind or take an export — and is then deleted for good, backups included. One honest caveat: nothing in Novus ends a paid period yet, because no payment provider is wired up, so there is no timer running against this today. The 30 days is the commitment; the mechanism follows the subscription.

Your work leaves as files

Every board exports its schedule as CSV, without asking anyone. Metrics pages and reviews export as CSV or Excel, and a review presentation as PowerPoint, PDF, or a spreadsheet of its figures. An account-wide export is not built yet.

Every figure says where it came from

Each number in Metrics names the data it was worked out from — Actual, Synthetic or Simulation — and only Actual readings raise a signal. Layers lists the files and rules behind a page. A review presentation puts a source line on every page and ends with its assumptions and the method used for each exhibit, so whoever reads it can check it.

The demo holds nobody's data

The working demo is a fictional company, built by a script from made-up records. Visitors open it read-only — nothing they do changes it or is kept — and it sends nothing to a model.

Metrics only is read-only over your records

A workspace set to Metrics only has no Project Board, and with it no way for Metrics to write anything back into project records. Everywhere else, Metrics reads the board and changes one thing on it: a person marking work as waiting on someone. Take the board away and even that is gone — Metrics reads what you give it and writes nothing.