How Nodu keeps each household's money data apart

Many apps keep customers apart by remembering to filter: every query asks for this customer's rows and no one else's. Forget once, and one customer sees another's data. Nodu is built so that kind of mistake can't reach your household.

The database refuses#

Nodu reaches household data in one of two ways: as a restricted login set to a single household, or as you, through your own signed-in session. Neither can get around the database's rules, and each table hands back only your household's rows. When no household is set, every query comes back empty: it fails closed.

Which household a request belongs to comes from your signed-in session, never from the model. Nothing Nodu writes can choose whose data a query touches.

Database tests check that every household table has its rule, and that any function the app can use to reach across households is on a short list a person has reviewed. They run before any change to the database leaves our machines.

Your household's own key#

Statement files get a second lock. Each household has its own 256-bit key, and a file is encrypted with it (AES-256-GCM) before it's stored. Stored that way, it can't be read without your household's key, and it can't be changed without Nodu noticing. Nodu decrypts a file only in memory, to read it. The household keys are themselves encrypted with a master key kept outside the database.

When you delete your statement files or your household, Nodu destroys your household's key first, then deletes the files. Backups don't hold the files, and the locked copy of the key in backups is gone within 7 days.

Less to lose#

Data Nodu never keeps can't be lost. Your account records keep only the BSB and the last 4 digits, and the database refuses anything longer. There's no field anywhere for a banking password. Nodu's logs record counts, and leave out your figures and descriptions.

Sign-in is by a link or a code sent to your email, so there's no Nodu password to steal.

Claude reads, and that's all#

When Claude reads a statement or sorts your spending, that call has no tools. It can't use the web, send messages or take actions. Nodu treats text in a statement as information, never as an instruction. With no tools, a hidden instruction has nothing to act on, and when the model does go along with one, Nodu's own checks catch it. The answer has to match a strict format before anything is saved.

Nodu's figures come from your own ledger, through its tools, and its instructions don't let it state a number it didn't get from one.

Limits written into the code#

Nodu can't move money. No code in it can pay, transfer or change a bank setting.

When Nodu starts doing things outside Nodu for you, like a call or an email to a company, each one will wait for an approval it records. Above $500, that means both of you.

The limits that apply today live in Nodu's code as well as in the model's instructions: nothing in Nodu can pay, and it has no tool that can send or approve anything. Approvals will be built the same way. Any change that touches one of these limits needs a person to review it before it ships.