Your projects contain product decisions and original work. Nodlume uses layered safeguards to keep that information private, intact, and available only to the people you authorize.
Identity
Server-verified sessions
Projects
Access checked per request
Payments
Card data handled by Stripe
How we protect you
Protection is applied at sign-in, on every data request, across infrastructure, and during payment processing.
Account protection
Sign-in is handled by Firebase Authentication. Sessions use a short-lived, httpOnly cookie that JavaScript cannot read, and every request that touches your data is verified on the server — not just at the edge.
Access control
Access checks run in our API layer on every mutation. Project reads and writes verify that you own the project or were invited to it; share links grant only the access they were created with.
Data protection
All traffic is served over HTTPS. Project data is stored on Google Cloud infrastructure, which encrypts data at rest and in transit between services.
Billing security
Payments are processed by Stripe, a PCI-DSS Level 1 provider. Card details go directly from your browser to Stripe; Nodlume servers never see or store your card number.
Shared responsibility
A few careful habits make Nodlume’s built-in safeguards more effective.
Common questions
Quick answers about how Nodlume protects your account, projects, and payments.
Please report it privately rather than disclosing it publicly. Include steps to reproduce the issue and the impact you observed. We will acknowledge your report, keep you informed while we investigate, and will not pursue action against good-faith research that avoids privacy violations, data destruction, and service disruption.
Submit a private reportWe'd like to use Google cookies to understand how Nodlume is used and to measure our advertising. Nothing loads until you choose, and declining does not affect anything in the app.
Nodlume