Security and data

This page explains how NAU Labs protects the information you trust us with, in Harness and in the systems we build for you.

At a glance

• We use your data only to provide and support your service. We never sell it, and we never use it to train AI models.
• Hosted Harness runs on servers we set up and operate for your company, and you reach it over encrypted connections.
• People sign in with Microsoft or Google, and logins for connected accounts are stored encrypted.
• AI providers receive the content needed for each request, under their own terms.
• Work that has to meet rules like HIPAA is done as a private build, made only for you.
• We do not hold security certifications such as SOC 2 or ISO 27001 yet, and we are glad to answer your questions about our practices.

This page describes only what we do today. The Harness Terms explain in detail how Harness handles your information.

Where your data lives

• Harness desktop app. Your workspace is stored on your own computer.
• Hosted Harness. Your workspace is stored on the server we operate for your company.
• Outside services. The AI provider in use receives the content each request needs. Web searches go to search engines such as DuckDuckGo, Bing and Brave. If you sign in with Microsoft, a copy of your chats is kept in your own OneDrive by default.
• Custom builds. Your systems run on the infrastructure we agree on with you, and your data stays yours.

How we protect it

• Encrypted connections. Hosted Harness and this website are reached over HTTPS.
• Sign in with Microsoft or Google. There are no separate Harness passwords, sessions end after 30 days, and a hosted workspace can be limited to your organization’s accounts.
• Encrypted logins. Logins for the accounts you connect, such as Microsoft, Google or cloud storage, are stored encrypted.
• Separate accounts. Each person’s chats and files are kept under their own account.
• Approvals. On a computer paired with Harness, the default Ask first mode asks for approval before Harness acts there.
• Records. Harness keeps records of its work and of deletions.
• Limited access. People at NAU Labs access customer data only to run, support or fix the service, or when the law requires it.

Custom builds and engineering

When we build or run a system for you, we use your data only to build, run and support that system. We keep only what the work needs, give access only to the people working on it, and when the work ends, we return or delete your data as our agreement says and remove our access.

AI providers and other services

Some services we rely on handle data for you. They each work under their own terms:

• AI model providers, such as OpenAI, Anthropic and Ollama, for the requests Harness sends.
• Microsoft and Google, for sign in, and for mail, calendar and files when you connect them.
• Search engines, such as DuckDuckGo, Bing and Brave, for the web searches Harness runs.
• Notification services, run by browser and device makers, for alerts.
• Hosting companies, for the servers we operate.
• FormSubmit, when it delivers messages from the contact form on this website.

Certifications and compliance

We do not hold SOC 2, ISO 27001 or other security certifications, and Harness is not offered for protected health information under HIPAA. Work that has to meet compliance rules is done as a private build, planned with you and your advisors. If your organization needs a security questionnaire answered, contact us.

If something goes wrong

If we learn of a security incident that affects your data, we will tell you without undue delay and as the law requires, and we will work with you to respond.

Regulated work

Law firms, clinics, accounting firms, insurance agencies and others whose work has to meet rules get a private build instead of shared software. It runs in an environment you control or one we set up only for you, connects to AI services under agreements that fit your rules, gives each person only the access their role needs, and is planned with you and your advisors, including the agreements it requires. Harness itself is built for everyday business work.

Report a security issue

If you find a security problem in our website or software, please tell us using the contact details below or the details in our security.txt file. Please give us time to fix it before sharing it publicly.

Contact us

For questions about security or your data: Email us at our email address, or use our contact form.