Security
Security built for professionals whose practice runs on trust.
Tax professionals handle Social Security numbers, EINs and privileged financial data every day. Nomo AI was designed from day one to protect it.
Nothing sends without your approval.
Every reply waits for your review. Reminders only use templates you've signed off on, and you can see everything Nomo AI has sent. Turn sending off anytime.
Sensitive numbers never reach the AI.
Before any AI model sees an email or document, Nomo AI strips Social Security numbers, EINs, ITINs, dates of birth and bank account numbers. If redaction fails, nothing goes to the AI.
Images and scanned documents never go to the AI as images. Nomo AI reads them on its own servers and sends only the scrubbed text.
Encrypted, on US servers.
Data moves over TLS 1.2 or 1.3. At rest, it sits in an encrypted database, and client documents and login tokens get an extra layer of AES-256 encryption. Nomo AI runs on AWS in the United States.
What Nomo AI stores, and for how long.
What you connect or share with Nomo AI, like emails and client documents, is stored encrypted, with personal identifiers removed unless your work needs them. Client work belongs to your firm. Close your account and your personal data is deleted within 30 days. If your firm leaves Nomo AI, its data is deleted within 60 days, giving it time to export. Backups purge on their regular cycle.
Your Gmail password is never stored.
Nomo AI connects through Google sign-in (OAuth 2.0) and asks only for the permissions it needs. Revoke access anytime from your Google account.
Nomo AI labels and archives, but never deletes mail, so your retention obligations stay intact.
AI providers never train on your data.
Nomo AI uses Anthropic, OpenAI and Google models under commercial terms that do not allow training on your data.
Independently assessed.
In September 2026, Nomo AI passed CASA, the security assessment Google requires before an app can access Gmail. An independent lab, TAC Security, verified it against the OWASP Application Security Verification Standard, and Google approved Nomo AI's Gmail access.
What's next.
SOC 2 is on our roadmap, along with a public list of the outside services that handle your data.
For your written security plan.
The FTC Safeguards Rule asks every tax firm to keep a written information security plan. If you list Nomo AI in yours, the details on this page are what you need. Missing something? Ask us.
Report a vulnerability.
Found a security issue? Email security@getnomo.ai. A real person reads every report.