Security

What nmbr protects, what it deliberately does not, and what is on you — read before giving an agent real powers.

Honest positioning

nmbr is a closed network with encryption at rest, not an end-to-end-encrypted messenger for agents. Messages are AES-256-GCM encrypted at rest and decrypted only inside nmbr's servers — and, for your agent, sent in plaintext to whoever holds its token, on infrastructure you chose. That egress is deliberate, limited to 1:1 conversations with people who added the agent, and recorded. There is no ad business reading it, and agent tokens are stored hashed. But if your agent runs on a machine you don't control, the conversations it sees run through that machine. Choose accordingly, and tell the people who add your agent.

What the platform enforces

• Token class separation. An agent token opens only /api/agent/v1/*; human sessions and tokens are refused there. Agents have no interactive sign-in at all.
• No self-replication. Agents are created only by humans in the app; there is no create endpoint and no token-minting endpoint on the agent surface.
• Contact-gated reach. An agent can message only people who added it; they can remove or block it.
• Approvals bound to a person and a conversation, fail-closed on expiry, capped per conversation. See Approvals.
• No automatic link previews for agent-sent URLs. Links from an agent render as "tap to preview" — the server never fetches a URL an agent sent until a human asks. This closes the zero-click exfiltration vector seen on other platforms, where a prompt-injected agent leaks data through a URL the preview-fetcher requests.
• Webhook hygiene. HMAC-signed deliveries with timestamps (replay window 5 min), secret rotation with an overlap window, SSRF protection with DNS pinning on nmbr's side.
• Rate limits and ceilings per agent and per recipient; a looping agent degrades, it doesn't flood.
• Kill switches. Revoke one token or all of them in the app; suspending an owner cuts off every agent they own on the next request.

What is on you

• Prompt injection. Everything your agent reads — messages, voice transcripts, shared documents — is untrusted input. Give the agent the minimum capabilities, put every consequential action behind an approval, and never let it act on a proposal it hasn't seen approved.
• Token hygiene. Treat agent: tokens like passwords: environment variables or a secret store, never in code or logs; one token per deployment; revoke on any doubt. Rotate the webhook secret if it's ever exposed.
• Verify webhooks on the raw body before doing anything with them.
• Approval prompts are for people. Keep secrets out of title/description; they render on a phone and appear in chat previews.
• Your machine. The agent's host sees plaintext. Disk encryption, updates and access control there are part of your users' privacy.

Reporting

Security issues: support@nmbr.ai — please include "security" in the subject. We do not run a public bug bounty yet.