Security

How Node9 handles your data, credentials, and audit trail.

What Node9 sees — and what it doesn't

Node9 only evaluates concrete tool call parameters — the tool name and its arguments at the moment of execution. It does not read, store, or transmit:

AI-generated conversational context or chat history
The content of files unless they are the direct argument to a tool call
Network traffic, browser sessions, or environment variables

Credential storage

OAuth tokens (Slack, Google) are AES-256 encrypted at rest before being written to the database.
API keys are stored as SHA-256 hashes — the plaintext key is shown once at creation and never stored.
Passwords are hashed with bcrypt (cost factor 10).
Access tokens expire after 15 minutes; refresh tokens after 7 days. Refresh tokens are rotated on every use.

Audit logs

Every intercepted tool call is written to ~/.node9/audit.log with:

Tool name, parameters (secrets redacted), and decision (ALLOW / BLOCK / REVIEW)
Agent identity, OS platform, and shell type
Timestamp and which channel produced the decision (native, browser, cloud, terminal, rule)
Shadow decision (what would have happened in non-shadow mode)

In cloud mode, the same entries are also synced to Mission Control with the requester's IP and user agent. Cloud retention is plan-dependent: 30 days (Developer), 90 days (Startup), 365 days (Business+). Local audit logs are retained until you delete them.

DLP — secret detection in tool arguments

The built-in Content Scanner inspects every tool call argument for credentials before policy evaluation. Matches are hard-blocked (AWS keys, GitHub tokens, Stripe keys, PEM private keys) or routed for human review (Bearer tokens). Secrets are redacted to a prefix+suffix sample in all logs — the full value is never persisted. See the Content Scanner (DLP) section for the full pattern list and config options.

Workspace isolation

Every resource — policies, API keys, audit logs, agent requests — is scoped to a workspace ID. Cross-workspace queries are rejected at the database layer, not just the application layer. Multi-tenancy is enforced via row-level workspace ID checks on every Prisma query.

Panic Mode & rate limiting

Panic Mode — a kill switch that blocks all agent actions across the workspace instantly, overriding every other policy including Shadow Mode.
Rate limiting — the intercept endpoint is throttled at 300 requests/minute per IP to protect against proxy abuse.
Request deduplication — duplicate calls within 5 seconds from the same agent are collapsed to prevent double-execution from Claude Code's hook system.

Local mode — zero cloud exposure

Running node9 login --local keeps all policy decisions on your machine. No tool call data is sent to Node9 servers. See the Privacy & Cloud Mode section for the full breakdown.

Responsible disclosure

Found a security issue? Email security@node9.ai before public disclosure. We aim to acknowledge reports within 24 hours and patch critical issues within 72 hours.

Security · node9 documentation

Security