How NOVA keeps your information safe

Effective May 4, 2026 · Last updated October 6, 2026

A summary of The Transformation Room's Information Security Policy, as it applies to you. Questions: privacy@yournovabrain.com.

Who can get in

• You sign in with Google. Each account belongs to one person, and anyone 18 or older can create one.
• Your session is kept in a secure, signed cookie that scripts on the page can't read. It expires after 30 days, and you can sign out on every device at once.
• Every request is checked against your account. No one else's account can read your information.
• Connecting a bank needs a code from your authenticator app (two-step verification).
• The phone app has its own key, and NOVA stores only a scrambled (hashed) form of it.

Encryption

• Everything travels over HTTPS (TLS 1.2 or higher), and the database connection is encrypted too.
• Stored information is encrypted by our hosting and database providers. On top of that, NOVA encrypts access tokens for your connected accounts (including Plaid) with AES-256-GCM.
• Secret keys live only on NOVA's server. They never reach your browser or phone, and they are never written to logs.

Nothing happens without you

• Anything that reaches the outside world, like sending an email, adding a calendar invitation or posting, waits for your approval unless you have deliberately switched on an automation with limits.
• Emails, web pages and files that NOVA reads are treated as information, never as instructions.
• NOVA can't move money, make payments or place trades.
• Every action keeps a receipt: what was done, where, from which account, and whether you approved it. You can see your history in NOVA.

Only what's needed goes to the AI

For each request, only the relevant pieces of your information are sent to the AI model, never your whole history. It is sent under the provider's API terms, which don't allow it to be used to train their models.

How NOVA is built and looked after

• Every change is reviewed, tested and previewed privately before it reaches NOVA, and any release can be rolled back in minutes.
• Every account that can reach NOVA's systems uses multi-factor authentication.
• Automated checks watch for failing tests, security alerts, and website and certificate health every day. Critical fixes are made within 7 days.
• Access to NOVA's systems is reviewed every quarter.

If something goes wrong

We contain the problem straight away (revoking keys, ending sessions, pausing automations), find out what happened, and tell affected people without undue delay, within 72 hours of confirming an incident where possible, as well as Plaid and regulators where required.

More

See the privacy policy for what NOVA collects and why, and data retention and deletion for how long it's kept.