Audited against the implementation

Security

How NoTalk protects your accounts, credentials, and data — stated only as implemented.

Transport

notalk.app and the API are served over HTTPS.

Passwords

Passwords are hashed with bcrypt (cost factor 10) — plaintext is never persisted.
Password reset links are single-use and expire within one hour.

Sessions

Sessions are HMAC-signed JWTs verified on every request, expiring after 24 hours.
Session cookies are HttpOnly with SameSite=Lax, so page scripts cannot read them.

API tokens

Tokens carry an ntk_ prefix so they are greppable without exposing the secret.
Only a hash is stored server-side; the full token is shown exactly once, at creation.
Scopes are checked on every request (fail-closed) and revocation takes effect immediately.

Rate limits & abuse

Message sending is capped at 30/minute per account; concurrent requests are bounded server-side.
Spam and beta-access resale lead to suspension — see Terms §2.

AI & automation

Copilot drafts replies with conversation context; Autopilot auto-replies are recorded for review.

Data

Your workspace data remains yours — export or delete it at any time. Deleting an account removes its session and associated data.

Report a vulnerability

Found something? Tell us through the contact page with Security: in the subject, including reproduction steps. Please stay in scope, avoid degrading the service for others, and give us a chance to fix before disclosing.