Security at NOME

NOME is organized as a control plane and a set of execution planes. The control plane handles authentication, workspace management, and the API. Execution planes run environments. The two communicate over authenticated, encrypted channels and are deployed in separate network segments.

All traffic between clients and NOME is encrypted in transit with TLS 1.2 or higher. Data at rest — snapshots, run records, specifications, and workspace metadata — is encrypted using provider-managed keys with per-tenant key derivation.

Infrastructure is defined as code and deployed through reviewed, audited pipelines. Production changes require review by a second engineer and are recorded with the identity of the approver.

NOME stores the data required to operate your environments: specifications, snapshots, run records, registered artifacts, and workspace configuration. We do not store private keys for accounts outside NOME, and NOME never asks for them.

Environment data belongs to the workspace that created it. It is not used to train models, shared with other customers, or accessed by NOME staff except for support you request or incident response, and such access is logged.

Archived environments retain snapshots for the period described in Limits, after which they are deleted from primary storage and expire from backups on a rolling schedule. Workspace deletion removes all associated data within 30 days.

Every environment runs in its own isolated execution context with dedicated state storage. Environments cannot observe or affect one another, and no environment has outbound network access by default.

Environments are never connected to a public network for execution. Importing public state is a read-only, point-in-time operation performed by the control plane, not by the environment itself. Nothing executed inside an environment is broadcast anywhere.

Execution contexts are ephemeral. When an environment is archived, its context is destroyed and its compute resources are reclaimed; only the encrypted snapshots persist.

Access to a workspace is granted through user accounts with role-based permissions and through API keys with explicit scopes. Keys are hashed at rest, shown once at creation, and can be rotated or revoked at any time.

Single sign-on and enforced multi-factor authentication are available for organizations. All authentication events, key operations, and administrative changes are recorded in an audit log available to workspace administrators.

Internal access to production systems requires hardware-backed multi-factor authentication, is granted on a least-privilege basis, and is reviewed quarterly.

We welcome reports from security researchers. If you believe you have found a vulnerability in NOME, please report it to us privately before disclosing it publicly. We commit to acknowledging reports within two business days, keeping you informed of progress, and crediting reporters who wish to be credited.

When reporting, please include:

• A description of the issue and its potential impact.
• Steps to reproduce, including any relevant request and response samples.
• The workspace or environment identifiers involved, if applicable.

Please do not access data that is not yours, degrade the service, or test against other customers' workspaces. Testing within your own workspace is always permitted.