Security & disclosure
This policy is published by Nova Finance LLC (in formation), which operates under the brand name Nova (“Nova”, “we”, “us”). It explains how we will and will not contact you, the security measures in place today, and the terms under which security researchers may test our services and report what they find.
Nova will never ask you for a seed phrase, a private key, a password, a card number or a payment. We have no means of accepting any of them, and no reason to want them. Anyone asking for one in Nova’s name is not Nova. There is nothing to invest in, no token and no presale.
1. How we contact you
- We contact you by email only, from the novacard.us domain, and only about the waitlist or your account.
- Account-confirmation and password-reset emails contain a six-digit code. We will never call, text or message you to ask for that code or for your password. Anyone who does is attempting to take over your account.
- We do not operate a Telegram group, a Discord server or any account that sends direct messages about early access. If you see one presenting itself as Nova, please report it to security@novacard.us.
2. Measures in place
The following describes the security measures in place today. It is a factual account, not a certification.
- All traffic is served over HTTPS with HSTS. HTTP requests are redirected and never served.
- A content security policy denies every source by default and blocks plugins outright. One third party is permitted: Cloudflare Turnstile, which protects the waitlist form from automated sign-ups and loads a script and a frame from challenges.cloudflare.com. This site loads no analytics, no advertising pixels and no third-party fonts, and sets no cookies of its own.
- You sign in with an email address and a password. Your password is handled by our authentication provider, which stores it in hashed form. Nova never sees it and keeps no copy. Confirming a new account and resetting a password each use a six-digit code sent by email, which expires after a short time.
- Two-factor authentication with an authenticator app is supported.
- App sessions are stored in the iOS Keychain rather than in ordinary app storage.
- The app can be locked with a passcode and Face ID, and locks automatically when you switch away from it.
- The app’s simulated financial history is stored with iOS file protection enabled, so it cannot be read while your device is locked.
- Simulated financial data never leaves your device. There is no server-side copy that could be exposed.
- Administrative access to our service providers requires two-factor authentication.
- Secrets are kept out of our source code, and our code repository is scanned for them.
What we do not claim: that these measures have been independently audited, certified or penetration-tested, or that they are unbreakable. We will update this page if any of those statements becomes true.
3. Reporting a vulnerability
If you find a security issue, please report it to us before disclosing it elsewhere. We welcome good-faith reports and will not pursue legal action against researchers who follow this policy.
Email security@novacard.us with enough detail for us to reproduce the issue. If you would like to encrypt your report, let us know and we will arrange a key.
3.1 What you can expect from us
- An acknowledgement within 3 working days.
- An initial assessment and remediation plan within 10 working days.
- Public credit on this page once the issue is resolved, if you would like it.
Nova does not currently operate a paid bug bounty programme.
3.2 What we ask of you
- Give us reasonable time to resolve the issue before you publish it.
- Do not access, modify or delete data that is not yours. If you reach someone else’s data, stop, and report what you saw and nothing further.
- Do not carry out denial-of-service testing, spam, social engineering of Nova or its providers, or physical attacks.
- Test only against your own accounts and your own waitlist entries.
We consider testing that stays within these limits to be authorized, and we will not bring any claim against you in respect of it.
3.3 Out of scope
- Findings from automated scanners without demonstrated impact.
- Missing headers or configuration weaknesses with no practical exploit path.
- Issues affecting only unsupported or heavily modified browsers.
- Reports that Nova’s financial data is not real. It is simulated by design. See What Nova is today.
4. If you believe your account has been compromised
Email security@novacard.us straight away. A Nova account holds no real money today, so the potential impact is limited. We still want to know, and we will lock or close the account for you.
5. Contact
Security reports and account-compromise reports: security@novacard.us.
For anything else, including questions, concerns, corrections, or a statement on this site that looks inaccurate, write to hello@novacard.us. A member of the Nova team reads every message and replies directly.
6. Changes to this policy
This policy is versioned and dated at the top. We update it whenever a change affects what it describes.