Tenant isolation
Workspace data is queried in the account’s own database context. Row-level security is enabled on tenant tables so one account cannot read another.
Trust
Isolation is the product
We do not claim a named SOC audit on this page. We do describe the controls that are actually in the software today.
Last updated: September 20, 2026
7-day free trial • Stripe collects a payment method • Cancel before day 8.
Sessions
Signed HTTP-only session cookies. Production cookies are scoped to .nowstack.ai. API routes that are public (webhooks, trial, contact) use their own verification, not a user session.
Human-in-the-loop
Agents draft and route. Customer-facing sends and material workspace changes are designed to require a person. Internal notes and guest chat are visually separated in comms.
Search and the app
The authenticated product is noindex. robots.txt and X-Robots-Tag keep Command Center, settings, APIs, widgets, and previews out of search results.
Security event log
Sign-in, password reset, authenticator, role, account-switch, and Operator MCP tool-call outcomes (including rate-limit denials) are written as append-only, tenant-scoped rows. Client IP and user-agent are stored as hashes, not raw dumps. This is an engineering control in the software today — not a named audit or certification.
Security questionnaires: contact us.
Questions
Seven days on the real product.
Use the live workspace: Command Center, inbox, CRM, and agents with approvals. Stripe collects a payment method. Cancel before day 8 or Stripe charges the price shown at checkout.