Where we stand
Nonu holds no regulatory clearance and no security certification, and claims none. Where a claim would need one, we do not make it.
This page describes the controls that actually exist, and names the gaps that do. It is written to be checked, not to reassure.
Nonu is a reporting workspace, not a diagnostic device. It is operated by one person, and it is honest about what that means: there is no SOC 2 report, no ISO 27001 certificate, no HIPAA attestation, and no business associate agreement on offer.
What there is instead is a small number of controls that are enforced by the code rather than by a policy document, and a written account of everything that is not covered.
1
Who can reach your work
Every read and write authorizes against the record being touched, not against what the browser claims to own. That check runs in the backend on every query, mutation, file read, file write, and collaboration connection, and an automated scan fails our build when a new function skips it.
Accounts are individual. A report is reachable by its author, by the people the author shares it with at the role they were given, and by anyone holding a share link the author created — no further. A revoked share, a rotated calendar link, and a deleted share link all stop working on the next request.
Credentials for every service we use are held server-side and never reach the browser. Access to a collaboration session uses a one-minute signed ticket rather than a token in a web address, so nothing durable ends up in a log or a browser history.
2
The record of what happened
Nonu keeps an audit trail of who did what to which record: report created, signed, amended, voided, exported, shared, and about seventy more actions. It never contains report text or patient identifiers — identifiers, counts, and statuses only.
That trail is append-only. Nothing in the product edits or deletes an audit entry, and a build-time scan fails if any code tries. Each day is then sealed with a cryptographic digest chained to the day before it, so a later change to a past entry can be detected rather than merely discouraged.
Signing is a single path. A report cannot reach a signed state without an issued, immutable snapshot, an attestation, and a content digest recorded at that moment. A digest is an integrity identifier — it proves the text has not changed since signing. It is not a legally qualified electronic signature, and we do not describe it as one.
3
How your data is handled
- Reports are stored as portable HTML, so what you write can always be exported as a document rather than locked into our format.
- Files and images are stored under keys that carry no meaning, and are served through an authorized proxy — never as a direct storage link. Temporary download links last fifteen minutes.
- Deletion is verified, not assumed: a deleted object is confirmed gone before the record of it is cleared.
- Unsaved work is kept encrypted in your own browser until you save it. That protects it from casual inspection of browser storage. It does not protect it from someone using your signed-in computer, and we say so where you turn it on.
- AI and dictation only reach a provider when you ask for them, and only with the part of the report the request needs. Offline dictation never leaves your device.
Retention is specific rather than general: report versions follow your plan's window, signed versions are kept, and anything under a legal hold stays. The full schedule, and what each provider holds, is published beside this page with the subprocessor list.
4
Clinical safety boundaries
Nonu supports documentation. It does not interpret images, detect findings, triage, or recommend treatment, and the built-in viewer is a reference viewer for drafting rather than a validated diagnostic display.
AI is assistive by design and by architecture: no model result, score, or automation can finalize clinical text or decide how a finding is handled. A person confirms every proposal, and a proposal that no longer matches the report it was made against is rejected rather than applied.
5
What we do not have
Stated plainly, so nobody has to discover it during procurement:
- No SOC 2 report, ISO 27001 certificate, or HIPAA attestation, and no business associate agreement. Do not use Nonu for HIPAA-regulated data.
- No external penetration test has been performed.
- No guaranteed data residency. Our providers process in their default regions, which we publish.
- No application-layer encryption of stored reports beyond what our infrastructure providers apply. Encryption in your browser covers unsaved drafts only.
- No regulatory clearance of any kind, because Nonu is not a medical device.
If your organization requires one of these, tell us before you deploy rather than after. The honest answer today may be that Nonu is not yet the right tool for your setting.
6
Reporting a security problem
Email support@usenonu.com with "SECURITY" in the subject. We aim to acknowledge within three working days and to assess within ten.
Please do not include patient information or medical images in the report. Research done in good faith — your own account, your own test data, no access to anyone else's information, and no automated scanning of the live service — will not be pursued.
If you find that something on this page is not true of the running service, that is itself a security report, and we want it.