Skip to content

Trust

Security

Nauro's safest mode is its default: the core runs locally and never calls out. When you opt into hosted sync, a small control plane stores your project context behind fail-closed authorization and encryption at rest.

Last updated: 1 June 2026. The Nauro CLI and core are open source under Apache 2.0, so the local-first claims below can be checked against the code on GitHub. The hosted control plane is operated by us and is not open source; the properties in that section describe how we run it.

Local-first by default

The core conflict-checking loop makes no external network calls. Retrieval (lexical BM25, and the optional embedding model) runs entirely on your machine with no API key. Your decisions live as plain files you control, and your source code is never read or transmitted by Nauro.

The hosted plane (opt-in)

When you enable cloud sync, a small control plane comes into play. We are not asking you to take this on faith about open-source code; it runs on our infrastructure, so the points below are the commitments we operate it under:

  • Authentication. Sign-in uses Auth0 with the OAuth Authorization Code and PKCE flow. Tokens are stored locally in an owner-only file.
  • Fail-closed authorization. Every hosted request is gated by a membership record. Unauthorized or malformed requests are rejected and never billed; access is denied unless a valid membership is present.
  • Encryption and isolation. Project context (decisions, state, and open questions, never your source code) is configured to be encrypted at rest in AWS S3 (us-east-1) using S3 server-side encryption, and access to each project is gated by a fail-closed membership check, so a request can read or write a project only if the account is recorded as a member of it. The server's own permissions are scoped to the project storage path.
  • Deployments. The service is deployed through GitHub OIDC, so there are no long-lived cloud credentials or stored deploy secrets to leak.

Telemetry

Product telemetry is anonymous, limited to a closed allowlist of event types, and never includes your content. Details and the opt-out are on the privacy page.

What we do not offer yet

We would rather be precise than impressive. Single sign-on with SAML, organization-level governance, and a self-hosted or private deployment of the hosted control plane are not self-serve products today. They are Enterprise conversations: if you need them, reach out.

Reporting a vulnerability

If you find a security issue, please email [email protected] with the details and steps to reproduce, and give us a reasonable window to respond before any public disclosure. Machine-readable contact details are published at /.well-known/security.txt.