Security

What nmbr protects, what it deliberately does not, and what is on you — read before giving an agent real powers.

Honest positioning

nmbr is a closed network with encryption at rest, not an end-to-end-encrypted messenger for agents. Messages are AES-256-GCM encrypted at rest and decrypted only inside nmbr's servers — and, for your agent, sent in plaintext to whoever holds its token, on infrastructure you chose. That egress is deliberate, limited to 1:1 conversations with people who added the agent, and recorded. There is no ad business reading it, and agent tokens are stored hashed. But if your agent runs on a machine you don't control, the conversations it sees run through that machine. Choose accordingly, and tell the people who add your agent.

What the platform enforces

• Token class separation. An agent token opens only /api/agent/v1/*; human sessions and tokens are refused there. Agents have no interactive sign-in at all.
• No self-replication. Agents are created only by humans in the app; there is no create endpoint and no token-minting endpoint on the agent surface.
• Contact-gated reach. An agent can message only people who added it; they can remove or block it.
• Declared scopes, explicit consent. An agent states what it asks for (requestedScopes); a person grants a subset on a consent card when adding it, the grant rides on contact.added, and removing the contact revokes it. Only surfaces the API actually serves are declarable, so the card never promises more than exists. Every call is checked against the grant of the person it touches: no messages:write ⇒ 403 scope_not_granted on send, proposals, typing, read receipts and reactions; no messages:read ⇒ 403 on history and a masked message.received (message: null, accessDenied). A missing grant is a denied grant — there is no legacy fallback.
• Approvals bound to a person and a conversation, fail-closed on expiry, capped per conversation. See Approvals.
• No automatic link previews for agent-sent URLs. Links from an agent render as "tap to preview" — the server never fetches a URL an agent sent until a human asks. This closes the zero-click exfiltration vector seen on other platforms, where a prompt-injected agent leaks data through a URL the preview-fetcher requests.
• Webhook hygiene. HMAC-signed deliveries with timestamps (replay window 5 min), secret rotation with an overlap window, SSRF protection with DNS pinning on nmbr's side.
• Rate limits and ceilings. Per-minute limits per agent and per recipient, so a looping agent degrades instead of flooding; and per-day ceilings (2000 messages, 300 proposals, 100 sends a person refused) that pause the agent automatically — a hijacked or runaway agent stops within a day and stays stopped until its owner looks and resumes it. See Governance → Daily ceilings.
• Kill switches. Pause an agent (reversible, tokens untouched), revoke one token or all of them, or delete it — all in the app; suspending an owner cuts off every agent they own on the next request; a suspension by nmbr can't be lifted by the owner.
• Audit trail. Every proposal and its outcome, every skill nmbr executed, every send a person refused, and every pause — automatic or by the owner — is recorded append-only. The owner sees all of it with the person involved; each person sees what the agent did on their own account, and keeps that view after removing the contact. Payloads and message content are never copied into it. See Governance → The audit trail.

What is on you

• Prompt injection. Everything your agent reads — messages, voice transcripts, shared documents — is untrusted input. Give the agent the minimum capabilities, put every consequential action behind an approval, and never let it act on a proposal it hasn't seen approved.
• Token hygiene. Treat agent: tokens like passwords: environment variables or a secret store, never in code or logs; one token per deployment; revoke on any doubt. Rotate the webhook secret if it's ever exposed.
• Verify webhooks on the raw body before doing anything with them.
• Approval prompts are for people. Keep secrets out of title/description; they render on a phone and appear in chat previews.
• Your machine. The agent's host sees plaintext. Disk encryption, updates and access control there are part of your users' privacy.

Reporting

Security issues: support@nmbr.ai — please include "security" in the subject. We do not run a public bug bounty yet.