Security

Noa acts in your browser, signed in as you, so it has to be hard to misuse: by a web page, by another program on your computer, by someone on your network, and by us. This page says how it is built for that, what we test, and what we don't claim. Every line here describes what the code does today, and the extension and the helper are open source, so you can check.

On your computer

• Web pages can't talk to Noa. The extension accepts no messages from websites and exposes no files to them, so a page can't drive it, read its settings or even tell that it is installed. Its own pages run under Chrome's strict extension policy: no remote code, no inline scripts, and model output is shown as text, never as HTML.
• The local helper opens no network port. Chrome starts it through native messaging, allowed for Noa's extension only. The AI tools reach it over a private pipe that needs a random token, and its files are readable by your user account only.
• The AI gets browser tools, nothing else. Your Claude Code runs with all of its own tools turned off: no shell, no reading or writing files, no settings or plugins from your other projects. Codex runs in a read-only sandbox with your own config ignored. They can only use Noa's browser tools.
• Files stay put. Noa can upload only files you gave it, or ones it saved for you, never an arbitrary file from your disk, so a page can't talk it into uploading your SSH keys or documents.
• Saved site logins are encrypted with AES-256-GCM under a key derived from your passphrase (PBKDF2-SHA256, 310,000 rounds). The key is kept only until you close the browser. A login is given to the AI only on its own site, and Noa refuses to put a saved password into a link or onto another site.
• Noa Browser updates are signed. Each release manifest carries an Ed25519 signature, and every file's SHA-256 is checked before it is installed.

Against tricks aimed at the AI

Text on a page can be written to look like instructions to the AI. This is prompt injection, and no one has a complete defense against it, including us. What Noa does about it:

• The AI is told that page content is data, not instructions.
• By default it waits for your OK before it posts, sends, pays, deletes, uploads or changes account settings. The card shows exactly what it is about to do.
• A download from an address that no page it read showed waits for your OK too, so a page can't use one to send your data somewhere quietly.
• Every step is kept in the activity log, and Stop ends a task at once.

The safety page says what you can do on your side.

Your account and our servers

• HTTPS only. noa.bot and app.noa.bot send plain HTTP to HTTPS, tell browsers to use nothing else (HSTS), and refuse to be framed by other sites.
• Sign-in with Google, checked on our server: the token's signature, audience and expiry. Accounts are matched by Google's account ID, never by email address alone. We never see your Google password.
• No passwords or keys stored in readable form. Session tokens and API keys are random and kept only as SHA-256 hashes. The dashboard's cookie is HttpOnly, Secure and SameSite, and every change made with it needs a header that other sites can't send.
• Sign out everywhere means everywhere: every session ends and every linked phone and computer is unlinked. Deleting your account deletes its data, not just the login.
• Each account sees only its own data. Every query is scoped to the signed-in account, and the admin pages answer only to named administrators.
• End-to-end encryption, if you turn it on: your chats, memory and remembered pages are sealed on your computer with AES-256-GCM, keyed by 12 recovery words that never reach us. While it is on, our servers refuse anything readable. Details in the privacy page.
• Your phone reaches your computer over an end-to-end encrypted channel (X25519 with ML-KEM-768, a post-quantum key exchange, then AES-256-GCM). Our relay can't read it.
• Limits on spending and storage. Hosted AI holds the cost of each request against your credit before it starts, phone calls end when the credit for them runs out, and uploads have quotas, so a bug or a stolen session can't run up an open-ended bill.

Compliance

Noa has not been through an independent audit such as SOC 2 or ISO 27001 yet, and we don't put badges on this site that say otherwise. What we can say is where your data goes and what those services are certified for:

We publish a security.txt (RFC 9116) so researchers know where to write. If your company needs a security questionnaire filled in, write to us.

What we test

Before we started telling people about Noa, we reviewed all of it the way an attacker would: the extension, the helper, Noa Browser, the account server, the website and the release scripts. We looked at it from the side of a malicious web page, another program or user on the same computer, someone on the network, another Noa account, and someone holding a stolen token. We fixed what we found, and each fix has a test that fails without it. Among them:

• Phone and computer links now end when you sign out everywhere or delete your account.
• A phone call on Noa's line can't outlast the credit that pays for it, and calls started at the same moment can't get around the one-call-at-a-time limit.
• Plain HTTP is sent to HTTPS on every Noa address, with HSTS and anti-framing headers.
• Run folders on your computer, which hold attachments and screenshots, are readable by your user account only.
• A saved password can't be put into a link, a download or another site's field.
• Files kept in your account have quotas, and only picture types are kept with a chat.
• The open-source copy of Noa is built only from files in version control, and checked for many more kinds of keys before it is published.

Thousands of automated tests cover Noa, among them the encryption, the sign-in checks and the permission rules, and a live suite drives the real agent against real sites every day.

Report a vulnerability

If you find a security problem, write to support@noa.bot with what you found and how to reproduce it. Please don't open a public issue for it, and don't access other people's data or disrupt the service while testing. We'll reply, keep you posted while we fix it, and credit you if you'd like.