Security
How Nodo protects your money and your wallet: who holds the keys, how to export them, how each movement is approved, and how we review the code. Last updated: 8 November 2026
Last updated: 8 November 2026
This page explains who controls your money on Nodo, what it takes to move it, and how we protect the platform. Where the money sits in each product is in Wallet and custody; the summary for compliance teams is in Compliance.
Summary
| How it works | |
|---|---|
| Your wallet | A Safe on Base, in your name. Nodo does not hold your key |
| Your key | You can export it at any time and use your funds without Nodo |
| Every movement | You approve it with Face ID, Touch ID, or a passkey |
| New device | Waits 24 hours before it can approve, unless you confirm it from the email we send you |
| Voice assistant | Prepares operations but cannot approve them |
| Contact | Nodo only writes to you by email, from an @nodoia.app address |
1. Your wallet
When you sign in to Nodo, your wallet is created: a Safe on the Base network, a smart wallet controlled by a key only the holder can use. It is created by Privy, our wallet provider.
- Nodo does not hold your key. The key is never written to Nodo's database. Nodo stores only your wallet's public address and verifies that it is yours.
- Nodo cannot move your funds. You sign every send. Nodo does not run a pooled crypto balance for its users.
- Your stocks and gold sit in that same wallet, on Base, in your name.
If you change phones
Your wallet does not depend on your phone. Sign in to Nodo with the same method as always (Apple, Google, or your email) and your wallet is there again, with the same address and the same funds.
Exporting your key
If you can still open Nodo, send your funds from the app. These steps are for when you can't. In the app, open Profile › Export wallet. It shows your Safe's address and two buttons, Export the signing key and Open the Safe:
- Address with the money. This is your Safe on Base, where the USDC sits. You can copy it.
- Export the signing key. It opens login.nodoia.app/exportar. Sign in with the same Nodo account and copy the key. It is the only key that controls your Safe.
- Import that key into MetaMask. It needs a little ETH on Base to pay the network fee.
- Open the Safe. This button opens your Safe directly in Safe Wallet, on the Base network. Connect MetaMask and send the USDC wherever you want.
Whoever has the key can move your funds: do not share it with anyone, including someone who says they are from Nodo.
2. How each movement is approved
- Signing in is not enough to move money. Every send, every currency conversion, and every purchase is approved on your device with Face ID or Touch ID in the app, or with a passkey in the browser.
- Each approval is good for one operation. The server issues a challenge for that exact payment, with its amount and destination. It expires after 5 minutes and cannot be used for another movement.
- New devices. A device you add to approve movements waits 24 hours. We send you an email: if it was you, you can confirm it there and use it right away.
- Voice assistant. Nodo's voice agent can prepare a send or a conversion, but it cannot approve it. Approval always happens on your device.
- OTC desk contracts. They are signed with Face ID or a passkey in the app, or with an email code on the contract page. Each contract keeps the signature, the IP, the browser, and a SHA-256 hash of the evidence and of the signed PDF.
3. Access to your account
- Ways to sign in. Apple, Google, an email code, or a wallet signature.
- Sessions. Each session uses a token that can be revoked. The Nodo team signs in with separate access.
- Email alerts. We tell you when someone signs in from a new device, when a new bank account is saved, and when a device that approves movements is added.
4. How Nodo contacts you
Nodo only contacts its clients by email, from an @nodoia.app address. We will never ask for your key or your codes, or ask you to install anything. If someone guides you by phone, WhatsApp, or another channel on Nodo's behalf, stop and write to info@nodoia.app.
5. Platform protection
- All communication with the API is encrypted.
- Permissions are checked on the server on every request.
- Provider keys are stored per environment and never reach the apps.
- The API and sign-in are rate-limited.
- Notices from Bridge and Stripe are verified by their signature before they are processed.
6. Code security review
In October 2026 we reviewed the code of Nodo's five applications (backend, web, app, internal admin, and desktop) with standard analysis tools:
| Tool | What it checks |
|---|---|
| Gitleaks | Keys or secrets in the full code history |
| Semgrep | Insecure code patterns |
| npm audit and OSV-Scanner | Known vulnerabilities in libraries |
| OWASP ZAP | Web exposure, on the test environment |
We then made two rounds of fixes. Result:
- No critical findings in production code.
- API, internal admin, and desktop: no critical or high findings.
- Secrets: every one found in the history was rotated, disabled, or deleted. Keys come from environment variables, not from the code.
- Web: no high alerts in the exposure scan.
7. Reporting a security issue
If you find a vulnerability, write to info@nodoia.app with the steps to reproduce it. We will reply and let you know when it is fixed.