Noumento connects to Slack, Microsoft 365 (Teams and Outlook mail), Granola and Notion.
From Slack and Microsoft 365 it reads messages only from the channels and mail folders each member chooses, and nothing is chosen for them.
In Slack it connects as the member, so it sees only what that member can already see.
Slack’s permission screen asks for access to direct messages, but Noumento does not offer direct messages for a member to choose.
In Microsoft Teams it reads channel messages only, never one-to-one or group chats.
In Outlook it reads the messages in the chosen folders, including their text, but not blind-copy recipients.
It does not download attachments or files from any source.
It does not read calendars, or files kept in Microsoft 365.
The connectors only read: they do not post, send, edit or delete anything in your tools.
In Granola it reads only the transcripts of meetings in the folders a member chooses, and of meetings not in a folder if they choose those too; it does not keep Granola’s AI summaries or private notes.
In Notion it reads only the pages a member picks on Notion’s own screen and the pages beneath them, and only once they have chosen how each area is shared.
What Noumento sends
If a team’s admin adds Noumento to their Slack workspace, Noumento can send a member their weekly review as a Slack direct message.
It sends the review only to a member who has turned it on, and that member can turn it off.
Adding it asks Slack for two permissions, to send messages and to open direct messages, and for none that reads a message.
Private until you share it
What Noumento learns from a member’s sources starts in that member’s private record.
It reaches the member’s team only when they approve it, or when they have set where it came from to share automatically.
Every channel and folder starts on review: nothing from it is shared until the member approves.
Anything a member does not act on stays private, unless they set where it came from to share automatically.
Automatic sharing still passes the sensitivity check, and anything the check cannot clear goes to review instead.
A member can take back something they shared, and the team stops seeing it unless another member shared it too.
A note an assistant saves for a member is private to that member until they approve sharing it.
Sensitive matters
Noumento checks what it reads for five kinds of sensitive matter: judgements about named people, pay, the company’s own deals and fundraising, legal matters about a person, and personal lives.
Content the check flags is never shared with the team.
When the check is unsure, the content is treated as sensitive. When the check cannot run, the content is held back, unshared, and checked again later.
Permissions in every assistant
Noumento answers an assistant from the asking member’s own private record and their team’s shared record, and nothing else.
No member’s assistant can read another member’s private record.
Noumento’s server works out who is asking from the access key Noumento issued to that member; naming another member, team or company in a request cannot widen what it answers from.
Customers share the same databases, and Noumento’s own access checks keep each company’s records apart.
Where data lives, and who processes it
Noumento’s servers, database and file storage run on Amazon Web Services in the Ireland region (eu-west-1).
Stored data is encrypted at rest: the database, the file storage and the server’s disks.
Connection credentials are kept in AWS Secrets Manager.
Data travelling between you and Noumento is encrypted with HTTPS.
The text Noumento reads, the questions assistants ask and the notes they save are processed by Google’s Gemini models, through Google’s Gemini API.
Google does not use the text Noumento sends it to train its models.
Noumento does not train models on your data.
Answers go to the assistant the member connects, under that assistant’s own terms.
Services that process customer data for Noumento: Amazon Web Services in Ireland (hosting), Google (Gemini models, which may process data outside the UK and EU), WorkOS in the United States (sign-in and invitation emails) and Pydantic Logfire in the EU (operational monitoring, with identifiers pseudonymised).
Every customer’s terms include data processing terms and the list of companies that process customer data for Noumento.
Noumento runs no analytics or advertising trackers, in the app or on this site.
Signing in
Members sign in through WorkOS’s hosted sign-in page.
Noumento keeps its own session in a secure cookie that page scripts cannot read.
Who at Noumento can see data
Only Noumento’s founder can access production systems, with two-factor sign-in, and that access is logged.
Noumento looks at customer content only to give support a customer asks for, to fix a fault, or where the law requires it.
Noumento’s own AI development tools do not read customer content.
Keeping and deleting data
Disconnecting a source stops Noumento reading it and deletes the stored credential, unless another of the member’s connections still uses it.
Disconnecting a source does not delete what Noumento has already read. Noumento deletes a customer’s data within 30 days of the customer asking or of its account ending, and backup copies expire within a further 14 days. An account ends when a subscription ends, or 30 days after a trial ends without a paid plan.
The database is backed up daily, and each backup is kept for 14 days.
Reporting a problem
To report a security problem, email security@noumento.com.