Your customers' messages, well kept.
What goes through Nodium is isolated, encrypted when it is a secret, signed when it leaves, and erasable.
Encrypted secrets
Meta tokens, webhook secrets, your users' tokens: encrypted with AES-256-GCM at rest, never returned in clear.
Keys kept as hashes
An API key is shown once. Nodium keeps only its hash; once revoked, it is refused on the very next call.
One client, one wall
A key sees only the clients of its account, or only the one it is pinned to. A resource from another account answers 404, never 403: it does not exist for you.
Configurable retention
Message content is kept 7 days on Build and 30 days on Launch, then erased; you can shorten it for a client. A person can be erased, for good, through the API.
Logged access
Every time the Nodium team opens a client, it is recorded: who, what, when.
Hosted in the European Union
Servers run in Paris, the database in Ireland.
Every outgoing call is signed
Webhooks carry a signature: you know it is Nodium.
- HMAC-SHA256 over the timestamp and the raw body.
- Two signatures for 24 hours after a secret rotation: nothing breaks on deploy.
- A stable event id, to ignore a duplicate.
POST /your/webhook HTTP/1.1Content-Type: application/jsonUser-Agent: Nodium-Webhooks/1X-Nodium-Event: message.receivedX-Nodium-Delivery: 7c0e…X-Nodium-Signature: t=1790000000,v1=5d41…,v1=a3f2…{ "id": "evt_5f1c…", "event": "message.received", … }Our subprocessors
The only services that process your customers' data for Nodium, and where.
| Service | Role | Where data is processed |
|---|---|---|
| Supabase | Database and file storage | European Union (Ireland) |
| Vercel | Application hosting | European Union (Paris) |
| Resend | Service and alert emails | United States |
| Stripe | Billing for your plan (no messaging data) | European Union and United States |
On-demand transformations go through subprocessors named in our privacy policy, with their countries.
The privacy policyA security question?
Write to us: we answer with the code in front of us.