Getting Started
What is Node9?Quick StartHow It WorksForecastAgent IntegrationsAccount & Machine
Configuration
ConfigurationPrivacy & Cloud ModeSmart RulesEffective ConfigurationPersistent DecisionsPause & Resume
Protections
Checks ReferenceShieldsSandboxSecurity PostureContent Scanner (DLP)Trusted HostsCanary CredentialsSkill PinningRepository ScanningEgress ControlBadges
Integrations
MCP GatewayMCP ServerPython SDKGoverned Agents
Operations
Mission ControlReportSecurityAgentic Threat CoverageBlast RadiusSessions & Live ActivityRedacting Session HistoryCloud Policy Rules
Help
Help & SupportAbout Node9

Security · node9 documentation

Security

How Node9 handles your data, credentials, and audit trail.

What Node9 sees, and what it doesn't
Node9 only evaluates concrete tool call parameters: the tool name and its arguments at the moment of execution. It does not read, store, or transmit:
  • AI-generated conversational context or chat history, with one exception: the response DLP scanner reads your local agent history on disk to flag secrets in model output, and that scan never leaves the machine
  • The content of files unless they are the direct argument to a tool call
  • Network traffic, browser sessions, or environment variables
Credential storage
  • OAuth tokens (Slack, Google) are AES-256 encrypted at rest before being written to the database.
  • API keys are stored as SHA-256 hashes: the plaintext key is shown once at creation and never stored.
  • Passwords are hashed with bcrypt (cost factor 10).
  • Access tokens expire after 15 minutes; refresh tokens after 7 days. Refresh tokens are rotated on every use.
Audit logs
Every intercepted tool call is written to ~/.node9/audit.log with:
  • Tool name, a privacy hash of the arguments plus a short redacted preview, and decision (ALLOW / BLOCK / REVIEW)
  • Agent identity, OS platform, and shell type
  • Timestamp and which channel produced the decision (native, cloud, terminal, rule)
  • Shadow decision (what would have happened in non-shadow mode)
In cloud mode, the same entries are also synced to Mission Control with the requester's IP and user agent. Cloud entries are kept for the life of the workspace, on every plan, so the record of what your agents did stays complete. Local audit logs are retained until you delete them.

Credentials are handled where they enter, not by deleting later: a row the DLP gate flagged stores no command preview at all, and a labelled credential is masked in the preview of any row that does store one.
DLP, secret detection in tool arguments
The built-in Content Scanner inspects every tool call argument for credentials before policy evaluation. Matches are hard-blocked (AWS keys, GitHub tokens, Stripe keys, PEM private keys) or routed for human review (Bearer tokens). Secrets are redacted to a prefix+suffix sample in all logs, the full value is never persisted. See the Content Scanner (DLP) section for the full pattern list and config options.
Workspace isolation
Every resource, policies, API keys, audit logs, agent requests, is scoped to a workspace ID. Cross-workspace queries are rejected at the database layer, not just the application layer. Multi-tenancy is enforced via row-level workspace ID checks on every Prisma query.
Panic Mode & rate limiting
  • Panic Mode: a kill switch that blocks all agent actions across the workspace instantly, overriding every other policy including Shadow Mode.
  • Rate limiting: the intercept endpoint is throttled at 300 requests/minute per IP to protect against proxy abuse.
  • Request deduplication: duplicate calls within 5 seconds from the same agent are collapsed to prevent double-execution from Claude Code's hook system.
Local mode, zero cloud exposure
Running node9 login --local keeps all policy decisions on your machine. No tool call data is sent to Node9 servers. See the Privacy & Cloud Mode section for the full breakdown.
Responsible disclosure
Found a security issue? Email security@node9.ai before public disclosure. We aim to acknowledge reports within 24 hours and patch critical issues within 72 hours.