Skip to content
Nuzz

Security

Last updated October 25, 2026

Nuzz works with your CRM, your calendar and your buyers' activity, so we take protecting that data seriously. This page describes the safeguards in place today. It's honest about what we don't have yet, too.

How Nuzz is built to protect your data#

  • Nothing changes without a person. Changes that Nuzz's assistant proposes to your CRM, and emails it drafts, wait for someone on your team to approve them. Every change is recorded in a change log with who made it, and can be undone. Nuzz never deletes CRM records.
  • The narrowest permissions we can. Gmail is connected with send-only permission, so Nuzz can't read your inbox. Google Calendar and Meet are read-only. Slack is send-only.
  • Admins control connections. Only a workspace's owners and admins can connect or disconnect its CRM.
  • No training on your data. We don't train AI models on your data, and our AI provider's commercial terms don't permit it to train on the data we send.

Encryption#

  • All traffic to Nuzz is encrypted with TLS (HTTPS), and browsers are told to always use HTTPS.
  • Data is encrypted at rest by our database and storage provider.
  • Access tokens for HubSpot, Salesforce, Google, Zoom and Slack are additionally encrypted with AES-256-GCM before they're stored.

Accounts and access#

  • Sign in with Google, or with a single-use email link that expires after 15 minutes. Nuzz doesn't store passwords.
  • Sessions use random tokens that we store only as hashes, in secure, HTTP-only cookies, and expire after 30 days.
  • Roles within a workspace (owner, admin, manager, rep) limit who can see team data and change settings.
  • Every request is scoped to the signed-in person's workspace, so one customer's data isn't visible to another.
  • In-app staff access is limited to named staff accounts with verified email addresses.

Application security#

  • Security headers, protection against cross-site requests, and validation of inputs.
  • Rate limits on sign-in, on the website tracking endpoint and on other public endpoints.
  • The website tracking script reads only identity fields from forms (never passwords or free text), and respects Do Not Track and Global Privacy Control.

Infrastructure#

  • Nuzz runs on Vercel (web application), Fly.io (background work) and Neon (database and file storage), all in the United States. See our Subprocessors.
  • Production secrets are kept out of source code and stored in our hosting providers' encrypted configuration.
  • Our database provider keeps point-in-time backups.

What we don't have yet#

Nuzz is a young company. We don't yet hold certifications such as SOC 2 or ISO 27001. If your security review needs more detail, email us; we're happy to answer questionnaires.

Report a vulnerability#

If you believe you've found a security issue in Nuzz, email security@getnuzz.com with the details. Please give us a reasonable time to fix it before disclosing it publicly, and don't access or change other people's data while testing. We won't take legal action against good-faith research that follows these guidelines.