Trust & security
A platform for security research, with clear limits on models, data and execution.
The platform and the models
Analyze code, investigate an attack hypothesis and review findings using the interfaces available to your account. NotHoly selects and integrates hosted models; it does not train or own the underlying model weights. The catalog identifies the base model, supported controls, practical limits and current customer rates.
Control over actions
Model output and source material are treated as data, not permission. Platform-executed actions use their specified scope, budget and exact-action approval. Native API function calls are returned for the caller to handle; they do not authorize unrestricted execution on NotHoly infrastructure.
Account and access controls
Account security includes password protection, supported authentication factors and passkeys, session controls and scoped API keys. Access checks apply to workspace content, sources and records. Paid inference also requires the appropriate entitlement or available credit; signing in does not bypass usage limits.
Know where your data goes.
Conversation history, native inference and account records serve different purposes. They do not share one retention promise.
- Chat and owned conversations
- Saved history lets you return to your work. Selected files, evidence and enabled memories can become part of later context. Owned CLI conversations keep their normal history.
- Native inference API
- The four native inference endpoints use encrypted processing caches. Access expires no later than 15 minutes after acceptance; activity does not extend the deadline.
- Usage and account records
- Content-free usage, payment, request-status and security records follow their own retention rules. Older backups and external processors are separate considerations.
Different data paths
Chat stores history so work can continue. The four native inference endpoints use encrypted processing caches with a fixed access limit of 15 minutes, separately from durable usage and security metadata. Owned CLI workflows retain normal conversation history.
Older records, backups and external model processing have their own retention considerations. Read Privacy for the distinction between cache access, active history and independent copies.
Evidence and service information
Keep source records and independently verify findings. A generated explanation is not proof that a scan, exploit or decompilation ran. Model configuration, service observations and independent security audits are different kinds of evidence; this page does not present one as another.
Evaluate or report a concern
For a team evaluation, describe your workflow, data requirements and integration needs. For a suspected vulnerability, send a minimal reproduction and the affected route or request identifier to support@notholy.com. Leave out passwords, live keys and unnecessary customer content.