Security & Compliance

Bite sized, Actionable, Tips, Tricks and API References

Nothing left untold

We take data privacy and security seriously. We maintain SOC 2 Type 2 certification and comply with GDPR and HIPAA standards.
 

Definitions

  • Novaflow: The interface for interacting with various AI models and AI agents (both provided and self-created). The interface includes plugins that perform specific tasks and connect to users' third-party applications and platforms.
  • End Users: People who subscribe to Novaflow. End users have access to all features in the chat interface (see plan definitions), including sending messages, creating prompts, adding AI characters, sharing and searching chats, and integrating apps.
  • The system: In this article, The System refers to the software's infrastructure.
  • AI Service: (or AI Provider) is a service that hosts AI models. Novaflow connects to these providers through their APIs to retrieve AI responses for end users.
  • Knowledge Database: A system for storing and processing training data that handles tokenization, chunking, and vector database queries. Novaflow connects to this system to retrieve relevant training data for end users.

Types of data

When using Novaflow, here are the types of data that the End Users will enter into the system.
  • Email: Collect only when the user login is to authenticate the end user.
  • Chat Messages: when the user starts sending messages to the AI.
  • Prompts, AI Agents: the user can create their personal prompt library for convenience.
  • Plugins: Pieces of software allowing the end user to perform specific tasks, access data (i.e. Web searches, content, etc) as well as to connect to 3rd-party applications and platforms.
  • User preferences: things like dark/light mode, font size, bookmarks, tags, etc., that help make the user experience better.
  • Training data: Uploaded documents (PDF, CSV, etc.) and connected online data sources (Notion, Google Drive, etc.)
 

Encryptions

All communication between servers and external services is encrypted in transit via HTTPS. Our app database, hosted by AWS, uses AES encryption for all data communications across the AWS platform—both in transit and at rest.
We do not provide end-to-end encryption to end users. While user messages are transmitted and stored securely between servers and external services (preventing man-in-the-middle attacks), the servers and external services can still read the user data. This access is necessary for core functionality—most importantly, enabling AI service providers to process user messages and generate responses.
 

External services

While we provide a detailed description of Novaflow's data flow, we cannot guarantee the same transparency for external services in your setup. Please review the privacy policy and security measures of any external services you use. AI Service Providers like OpenAI ChatGPT and Anthropic Claude guarantee they won't use your data for model training. For other AI Service Providers, be sure to check their respective privacy notices.