Security
How to check security.
Security depends on your deployment. Ask for the relevant settings, test results and procedures before using Nohm with your data.
01
Identity and access
Confirm the identity provider, authentication requirements, account lifecycle and access review process for your environment. Signing in and being authorised to use a feature are different checks.
Roles should limit access to the assistants, tools and project data each person needs. Ask for tests that show access is denied by default and removed when a role is revoked.
02
Data separation
Agree the deployment boundary for your organisation and how models, runs, documents and retrieval indexes are separated.
Ask for test results before using a deployment shared with other organisations. A website demonstration does not prove that private data is separated.
03
Providers, secrets and processing
Request the actual model-provider list, data regions and retention terms. Confirm how credentials are stored, rotated and revoked.
Ask for settings and contract terms covering model training, data location and encryption. Do not rely on general marketing claims.
04
Operational readiness
Backups need a restore test. Monitoring needs owners and escalation routes. Vulnerability management needs a documented response process.
Confirm logging, incident handling, recovery objectives and maintenance arrangements in the service agreement.
05
Current security claims
This site does not claim SOC 2 certification, ISO 27001 certification or a completed penetration test. Ask for any available assessments with their date, scope and unresolved findings.
Running models online and wider access still depend on licensing and technical checks.
06
Responsible disclosure
Send a concise report to info@terajouleenergy.com with “Security report” in the subject. Include the affected URL, observed behaviour and minimal safe reproduction steps.
Avoid accessing another user’s data, destructive tests or public disclosure of exploitable details. Stop if sensitive information appears. Do not send secrets in email. This page does not grant testing authorisation or promise a bounty.