Security

Last updated · 28 August 2026

Infrastructure

European hosting, encrypted at rest and in transit. TLS 1.3 on every public endpoint.

• Secrets held in a managed vault, never in application code or logs.
• Least-privilege scopes requested on every OAuth connection.
• Production access limited to named engineers, with an audit trail.

Your connected tools

Nallo asks for the narrowest scope that lets it do the job, and shows you exactly what each scope permits before you authorise.

You can revoke any connection in one click. Nallo keeps operating what it can and tells you what it lost access to.

Nightly checks

Every night Nallo verifies that each business it operates can still take money: certificate validity, checkout reachability, payment provider status and DNS.

A failure raises an alert before your customers hit it. Results are published on the status page.

Audit trail

Every action Nallo takes is recorded with its trigger, its reasoning and its outcome. The log is exportable and cannot be edited from the product.

Reporting a vulnerability

Write to security@getnallo.ai. We acknowledge within 48 hours and will not pursue researchers acting in good faith within the scope of a coordinated disclosure.