Lens is built for organizations that take their data seriously. This page explains how we handle, protect, and govern the information your team and your connected systems share with us.

If you're in IT, security, or compliance, this is the page for you. If you're a buyer or end user, the short version is at the top and the details below are here when your security team asks.

The short version

• We treat your data as yours. We don't sell it, mine it for unrelated purposes, or use it to train external models.
• We connect to your systems with the minimum permissions needed and never write back unless you explicitly enable it.
• Data is encrypted in transit and at rest using current industry standards.
• You can delete your data and revoke access at any time.
• We aim to meet and exceed the standards represented by SOC 2 and similar frameworks, and to lead — not follow — in how this space evolves.

How we think about security

At NomoCoda, security and data privacy aren't a checkbox exercise. They're foundational to how we build.

Voluntary frameworks like SOC 2 and ISO 27001 exist to help organizations signal mature security practices. While they are not legal requirements, some companies voluntarily choose to implement policies requiring these and other credentials for their vendors and partners. We fully respect the positions and policies of these organizations.

At NomoCoda, we aim to operate at or beyond the standards these frameworks represent. We aim to meet and exceed industry best practices, and our intent isn't to be a participant in this space — it's to lead it. As tools, threats, and customer expectations evolve, so does our approach. Privacy and security aren't a status we earn once. They're an ongoing posture we hold ourselves to.

What data Lens uses

To produce its intelligence, Lens reads data from the systems you choose to connect. This typically includes:

• Content and metadata from your connected workplace tools (for example, messaging, documents, and CRM data)
• Public information about your business and market context
• Information you and your team explicitly share with Lens during normal use

We never read systems you haven't connected. You can disconnect any source at any time, and doing so stops Lens from reading new data from that source immediately.

What Lens never does

• We do not sell your data. Ever.