Built to be checked, not just trusted.
"Own what you love" only means something if the record of what you own can't quietly change underneath you. Security on nommo isn't a policy document bolted on afterward, it's built into how purchases, payments, and accounts actually work. Here's what that looks like in practice.
Every purchase, resale, and physical order writes into a SHA-256 hash chain, each entry bound to the one before it. Periodically, the current state of that chain is anchored into the Bitcoin blockchain through OpenTimestamps, a free, independent service. Anyone can verify that a given record existed at a given time using any OpenTimestamps checker, with zero trust in nommo's word or nommo's database required.
The account nommo's live app connects with has UPDATE and DELETE revoked at the Postgres level on every provenance table. That's not a check our own code could get wrong. Even a bug in nommo's code, or a compromised server, is not capable of altering a past record, because the database role it runs as is not permitted to.
Checkout runs through our card processor or Flutterwave, both PCI-compliant processors that handle your card or bank details directly. nommo receives confirmation a payment succeeded and the amount, never your raw payment information. Every webhook is independently verified before it's trusted, a cryptographic signature check on the card rail, and for Flutterwave, a signature check plus a second, separate call back to their own API to confirm the transaction really happened.
Any account, creator or collector, can turn on two factor authentication from Settings. It's a real TOTP implementation (RFC 6238), built directly against Node's own cryptography rather than an opaque third-party package, and compatible with any standard authenticator app. Backup codes are hashed before storage, the same way passwords are, never kept anywhere in the clear.
nommo ships a real, nonce-based Content Security Policy, checked line by line against the actual codebase rather than pasted from a generic template: no inline script execution, no eval, only the handful of external hosts nommo genuinely calls out to. It exists to block the class of script-injection attack a policy like this is built to stop.
Failed sign-ins, two factor changes, refunds, disputes, and flagged content all write to a security log a human can review. That log, along with a written, plain-language incident response plan, is the first place we look the moment something looks wrong, not something improvised after the fact.
Where nommo actually stands
nommo is not SOC 2 or ISO 27001 certified. Those are formal, externally audited processes, and we'd rather say plainly that we haven't gone through one yet than let a badge imply otherwise. What's above is real: the actual controls running in production today, not a roadmap. As nommo grows, formal certification is a real next step we're working toward, built on top of the same controls this page describes.
Found a real security issue, or want more detail on any of the above? Reach us at hello@nommo.live.
Also read the Privacy policy and Copyright.