Security and Privacy
How Nanabase protects your contacts: field-level encryption with Google Cloud KMS, passwordless sign-in, roles and visibility, deletion, and what we do not claim.
This page explains how Nanabase protects your data today. The Privacy Policy is the legal statement of what we collect and why.
Who owns the data#
Your company owns its contacts. Nanabase stores them only to run your workspace. Your private contacts belong to your account, and you can export your data or delete your account at any time.
Encryption#
Connections to Nanabase use TLS.
On top of that, the most sensitive fields are encrypted one by one with AES-256-GCM before they are stored. The key that protects them is itself protected by Google Cloud KMS. These fields are encrypted:
- Email addresses, phone numbers and notes on contacts, private and company
- The email address and phone number on your account
- Email addresses and phone numbers on your card
- Email addresses in invitations and join requests
Names and company names are not encrypted this way. They are protected by the encryption Google Cloud applies to all stored data, and by access controls.
Who can see what#
- Private contacts are visible only to you. Your company and its admins cannot see them.
- Company contacts are visible to the members of that company, limited by each contact's visibility level. See visibility levels.
- Roles decide what each member can do. See Roles and permissions.
- Your card shows each detail only to the people you choose. The public card link shows your name and photo only, and search engines do not index it. See My card and links.
Sign-in#
- You sign in with a link sent to your email, or with Google. Nanabase stores no password.
- Each email link works once.
- Sign-in requests are rate limited. You can ask for up to 3 links in a short time. After that, wait a few minutes before asking again.
- A sign-in lasts 7 days and renews while you use the app.
- Sign out of all devices ends every session, including the phone app.
- You get an email when your account is used from a new kind of device or browser.
Deletion#
- A contact you delete is removed right away.
- Deleting your account removes your account, private contacts and cards right away, with no waiting period. Contacts you shared with a company stay with that company. See Account settings.
- An owner can delete a whole company. See Company settings.
Where data is stored#
Nanabase runs on Google Cloud and Vercel. The web app is served from the United States. Nanabase is made by BRBR Group LLC, a US company, for people in the United States.
What we do not claim#
- We do not hold SOC 2 or ISO 27001 certification today.
- Two-factor sign-in is not available yet.
- Single sign-on with a company identity provider is not available.
No system is completely secure. If you find a security problem, email hello@nanabase.co.