SecureNow never needs your source code.
Asking you to install a library in production and send it security telemetry is a big ask. This page says plainly what we collect, what we never collect, and how it is protected — no marketing.
What we collect — and what we never do.
Data collected
- HTTP request metadata: route, method, status code, timing, source IP, user agent
- Application traces and spans (OpenTelemetry) from your Node.js process
- Application logs you choose to forward
- Request bodies only if body capture is enabled — always passed through redaction first
- Session and user identifiers your app attaches, so attacks map to accounts, not just IPs
- Firewall events: what was blocked, rate-limited, or challenged, and why
Never collected
- Your source code — never. Your coding agent reads the repository locally; SecureNow only sees runtime signals.
- Passwords, tokens, authorization headers, cookies, and API keys — redacted at capture time, inside your process, before anything leaves your app
- Your environment variables or secrets files
- Anything from apps or routes you exclude from instrumentation
How your data is handled.
Redaction
Sensitive fields are stripped inside your process, before telemetry is exported. The redaction rules ship in the open npm package — you can read exactly what gets removed, test it with the `securenow redact` CLI, and extend the field list.
Encryption
All telemetry and API traffic is TLS-encrypted in transit. Account and configuration data is stored in MongoDB Atlas, which encrypts at rest by default. Telemetry is stored on AWS infrastructure in the EU (Paris region).
Retention
Telemetry retention follows your plan: 7-day history on Pro, 30-day on Team, custom on Scale. When retention lapses, data is dropped from hot storage. We keep what helps you investigate — not more.
Infrastructure
SecureNow runs on AWS in the EU. Scale customers get a dedicated, isolated telemetry instance — their data never shares a database with other tenants. Shared-tier data is isolated per tenant at the query-engine level.
Runtime performance & fail-open
The firewall check is an in-process, sub-millisecond lookup. Telemetry exports asynchronously in batches. Everything fails open: if SecureNow's backend is unreachable, your app keeps serving traffic normally. A monitoring outage is never your outage.
Secrets handling
Credentials live in local .securenow/*.json files, not environment variables, and the CLI tells your agent to gitignore them. The runtime key is scoped to ingestion and firewall sync; admin operations use a separate credential.
The MCP permission model.
Giving a coding agent access to production security tooling only works if the boundaries are explicit. SecureNow's MCP server draws them in three layers:
Read tools
Querying attacks, traces, logs, IP intelligence, and detection history. These are safe to hand to your agent — they cannot change anything.
Write tools
Blocking IPs, creating rules, changing rate limits. Every write tool requires an explicit confirmation flag and a reason — an agent cannot mutate your security policy as a side effect of exploring.
Human approval
By default, remediation is proposed, not executed. You approve, it runs, and it is reversible. Per-rule, you can opt trusted detections into automatic blocking once they have earned it.
Deletion
Delete an application and its telemetry stops being accepted immediately. Cancel a Scale subscription and your dedicated instance — traces, logs, metrics, dashboards — is scheduled for permanent deletion. Want everything gone? Email us and we delete your account and its data.
Vulnerability disclosure
SecureNow is built by an ethical hacker credited by Google, Microsoft, Meta, and PayPal for responsible disclosure — so we take reports seriously and respond fast. Found something? Email contact@securenow.ai and we will acknowledge within 48 hours. Good-faith research is welcome.
Security questions before adopting SecureNow? contact@securenow.ai — the founder answers these personally.
Comfortable with the boundaries? Try it.
14-day free trial of the full product. No credit card. Fails open. Reversible.