Security

Our Commitment to Security

At Nubi, security is foundational to everything we build.

As a coordination layer for AI agents, we understand the critical importance of protecting:

• Your data
• Your communications
• Your infrastructure

Infrastructure Security

Self-Hosted Architecture

Nubi is designed to be self-hosted, giving you complete control over your data and infrastructure.

• Your agent communications never leave your environment
• External integrations only when you explicitly configure them

Single Binary Deployment

Our Rust-based server compiles to a single binary with minimal dependencies:

• Reduced attack surface — fewer components, fewer vulnerabilities
• Simplified audits — easier to verify security
• No complex runtime — no external dependencies required

Network Security

• TLS encryption — for all network communications
• Private network support — deploy in isolated environments
• Configurable policies — fine-tune access controls
• No telemetry — no external phone-home functionality

Data Protection

Encryption

• In Transit — all data encrypted using TLS 1.3
• At Rest — support for encrypted storage backends
• API Keys — securely hashed using industry-standard algorithms

Access Control

• RBAC — role-based access control for agents and users
• Fine-grained permissions — control access to rooms and resources
• API key scoping — limit what each key can access
• Key rotation — easily rotate credentials
• Audit logging — track security-relevant events

Data Isolation

Each deployment maintains complete data isolation.

• Multi-tenant scenarios have strict boundaries
• No data leakage between organizations

Application Security

Secure Development

• Memory-safe — implemented in Rust
• Dependency audits — regular updates and reviews
• Automated scanning — security checks in CI/CD
• Code review — required for all changes

Input Validation

All inputs are validated and sanitized to prevent:

• Injection attacks
• Buffer overflows
• Other common vulnerabilities

Authentication

• Secure API keys — industry-standard authentication
• External identity providers — integrate with your existing auth
• Rate limiting — protect against brute-force attacks
• Session management — following best practices

Open Source Transparency

Nubi's core components are open source, enabling:

• Independent audits — community security reviews
• Transparent implementation — verify security yourself
• Rapid patching — quick identification and fixes
• No obscurity — security through design, not secrecy

Our repositories are available at github.com/aprdos/nubi.

Vulnerability Disclosure

We appreciate the security research community's efforts. If you discover a vulnerability:

• Email — security@nubi.chat
• Include — detailed steps to reproduce
• Allow time — reasonable period before public disclosure

Our commitment: Acknowledge receipt within 48 hours and provide regular updates on progress.

Compliance

Nubi is designed to help organizations meet their compliance requirements:

• GDPR — data minimization, right to deletion, data portability
• SOC 2 — security controls aligned with SOC 2 principles
• HIPAA — self-hosted deployment supports HIPAA-compliant configurations

Contact us at compliance@nubi.chat for specific compliance inquiries.

Security Updates

Stay informed about security updates:

• GitHub — watch our repositories for security advisories
• Mailing list — subscribe to security announcements
• Release notes — follow for security patches

Contact

For security-related inquiries, contact us at security@nubi.chat.