Trust

Security

Nodus is built so customer-visible state is durable, tenant-isolated, and recoverable.

• Auth. Bearer API keys hashed at rest (SHA-256). Issue via console signup or nodus-key.
• Tenant isolation. Workloads, events, ledger, and artifacts are scoped by tenant.
• Generation fencing. At most one generation writes durable progress per stage.
• Webhooks. HMAC-SHA256 signatures (X-Nodus-Signature).
• Ops. Optional NODUS_OPS_TOKEN gates reclaim endpoints.
• Brand lock. Customer routes expose Nodus catalog SKUs only.

Report vulnerabilities to nodus.infrastructure@gmail.com.