Security
Your data is protected by design
NOLYB is built on battle-tested infrastructure with security controls at every layer — from how you sign in to how your files are stored.
Encryption everywhere
All data in transit is encrypted with TLS 1.2+. Data at rest is encrypted using AES-256 on Supabase's managed infrastructure.
Row-level security
Database access is enforced at the row level using Supabase RLS policies. Even inside our infrastructure, queries are scoped to your workspace only.
OAuth 2.0 only
We never store your connector passwords. Third-party integrations (Google Drive, Notion, Slack, etc.) use short-lived OAuth tokens that you can revoke at any time.
Data deletion
When you delete your account, your content and personal data are permanently removed from our systems within 30 days — including all indexed files and embeddings.
Isolated workspaces
Every user's data is partitioned into an isolated workspace. There is no shared storage between accounts — your files are never visible to other users.
Trusted infrastructure
NOLYB runs on Railway (compute) and Supabase (database + auth) — both SOC 2 compliant platforms with their own rigorous security programs.
Infrastructure overview
| Component | Provider | Notes |
|---|---|---|
| Database & Auth | Supabase | RLS enabled, encrypted at rest |
| Compute | Railway | Isolated containers per service |
| AI processing | OpenAI | Inputs and outputs are not used to train OpenAI's models; abuse-monitoring logs retained up to 30 days |
| Payments | Stripe | PCI DSS Level 1 certified; we never see card numbers |
| Transactional email | Resend | Account and billing emails only |
| Audio transcription | AssemblyAI | Uploaded audio deleted within 48 hours; transcripts retained up to 30 days then auto-deleted |
AI and your content
NOLYB uses OpenAI to power semantic search and AI retrieval. Your content is sent to OpenAI solely to generate embeddings and answers. As of March 2023, OpenAI does not use API inputs or outputs to train its models. OpenAI retains abuse-monitoring logs for up to 30 days, after which they are deleted.
We do not use your content to train our own models or share it with other NOLYB users.
Found a vulnerability?
If you discover a security issue, please report it to us responsibly. We review all reports and respond within 5 business days.
Report a vulnerabilityQuestions about our security practices? Email hello@nolyb.com.