Security and data protection at Nodi

Where your data is stored

• Nodi for Ecommerce (app.nodicommerce.com) and Nodi for Service (app.usenodi.com) are hosted on Amazon Web Services (AWS) and Google Cloud Platform (GCP).
• Business data is kept in managed database services encrypted at rest with AES-256.
• Each business's data is kept to its own organization. Conversations from one business are never shown to, or shared with, another.

Encryption

• Data in transit: the apps are served over HTTPS, and the servers send security headers that tell browsers to use only secure connections.
• Data at rest: managed databases are encrypted with AES-256.
• Extra protection for your connected accounts in Nodi for Ecommerce: the access tokens for your WhatsApp, Facebook and Instagram connections, your payment gateway credentials and your courier credentials are encrypted again inside the app with AES-256-GCM before they are saved. The server will not start if the encryption key is missing, so these can never be stored in plain text by mistake.
• Passwords are never stored as typed. They are hashed with bcrypt, and sign-in session tokens are stored hashed too.

Sign-in and access control

• Every team member has their own login. New accounts, password resets and team invitations are confirmed with a one-time code sent by email.
• Roles and permissions: you decide what each role can see and do. Permissions are set per action (for example view, create, edit or delete) and are checked on the server, not just hidden in the app.
• In Nodi for Ecommerce, access can also be limited to specific businesses and branches, so staff at one outlet don't see another's data.
• Each device gets its own sign-in session with an expiry date.
• Sign-in, password and code endpoints are rate limited to slow down password guessing, and the whole API has request limits to stop abuse.

WhatsApp, Facebook and Instagram

• Nodi connects to WhatsApp through Meta's official WhatsApp Business Platform (Cloud API), using Meta's own Embedded Signup. Nodi doesn't use unofficial WhatsApp Web tools.
• You remain the owner of your WhatsApp Business Account. Nodi processes your WhatsApp data only on your behalf and under your instructions.
• In Nodi for Service, incoming WhatsApp webhooks are checked against Meta's signature before they are accepted, so forged messages are rejected.
• Meta processes message data to deliver it, under Meta's own data processing terms. Your Meta Business Manager may share message event data with Meta's ad systems; you control that setting in Business Manager under Business Info, then Data sharing.
• If one of your customers sends a stop or opt-out message, Nodi flags that contact and blocks further automated messages to them.

Payments and card data

• Your Nodi subscription is paid through Stripe Checkout, a payment page hosted by Stripe. Card numbers are entered on Stripe's page, not on Nodi's servers, and Nodi does not store card numbers.
• Payment notifications from Stripe are signature-checked before Nodi acts on them.
• In Nodi for Ecommerce, your shoppers pay on your payment provider's own hosted page (for example Stripe). Nodi keeps the order and payment status, not the card.
• In Bangladesh, local payments are processed by SSLCOMMERZ.

Your data and AI

• You own your data and the content Nodi's AI writes for you.
• We never sell your data, and we don't run third-party ads or remarketing in the product.
• Your messages, contacts, prompts and documents are not used to train shared AI models without your explicit opt-in consent.
• Nodi for Service lets you export your leads.

Data retention and deletion

• Account data is kept while your account is active.
• Message data is deleted when you close your account, or earlier on written request to [email protected].
• Disconnecting a YouTube channel or closing your account deletes that channel's data and access credentials.
• Billing and transaction records are kept for 7 years to meet tax and audit rules.

If something goes wrong

• Our privacy policy commits us to notify affected users and the relevant authorities within 72 hours of becoming aware of a data breach that puts people's rights at risk.
• If you think your own Nodi account has been accessed without permission, tell us right away at [email protected].

Report a security issue