For Nod privacy, what matters most is where data goes: Nod stores its database, files, memory and saved logins on the computer or server it runs on. Data still leaves the house, though. The model provider receives your conversation, what Nod reads for you, and screenshots. App connections such as Gmail or Slack go through an n8n service and Composio by default, web searches go through Exa, and usage data goes to n8n by default, though without your messages. You turn off usage data under Settings → Privacy & data; that does not delete anything already sent. For businesses with customer data, this means Nod is not a closed system but an agent with several recipients, and you check each of them as you would with any other AI service. All vendor details as of November 15, 2026.
I installed the Nod server from source on my Mac on November 15, 2026, version 0.7.6. It is only reachable on 127.0.0.1, answers 403 without a token, and only a helper container gets the Docker socket. Everything else is based on Nod's docs, mainly the pages "Your data and privacy" and "Security model and limits", retrieved on November 15, 2026. What Nod can do overall is in Nod by n8n: What the AI Agent Can Do, and everything I have written about AI agents is collected on my AI agents page.
What stays local
According to the docs, your model keys are stored encrypted on your installation and never enter a prompt, the workspace or Nod's browser. Encryption uses the Vault key, which macOS keeps in the Keychain, the Windows app protects with Windows DPAPI and the Linux Flatpak stores in Secret Service; a self-hosted server generates it in its private .env.
Memory notes come only from your own messages, your answers in the "About you" setup step and notes you add yourself, never from Nod's replies, websites or app data. If you connect Gmail, Nod reads your recently sent emails to learn your writing style, without facts or names according to the docs.
What goes to the model
The model provider receives your conversation, everything Nod reads for you, and screenshots. Image reading and the approval checks can use another service you connected. Background work such as memory upkeep uses a smaller model from the same provider.
Who decides on approvals is set in the server configuration with NOD_TRUST_MODEL. By default, your selected model checks at its lowest reasoning setting. In decision mode, Nod uses a specialised decision service, such as TypeSafe's Jev, Perplexity Decider through OpenRouter, or OpenAI Decisions. Such a service receives every action Nod checks, together with your messages and rules. Through OpenRouter, the checks go to TypeSafe according to the docs, even if your chat model comes from another provider. ChatGPT subscription credentials never go to a decision service.
Two settings shrink this part of the data flow. For an OpenAI project with EU data residency, choose the region "Europe (EEA + Switzerland)" in Nod; model requests, speech and OpenAI checks then go to eu.api.openai.com. And a local model through Ollama, LM Studio, vLLM or llama.cpp runs on your own hardware. How I weigh the cloud against your own server is in Local AI and Privacy: Cloud or Server?.
What goes to n8n and other services
The docs use an example to show what usage data means: if you ask Nod to reply to an email about an invoice, n8n learns that a Gmail tool ran successfully, which model answered with how many tokens and at what cost, and that it was a communication task. n8n does not learn the content of the request, the email or the reply.
If you turn on conversation traces, Nod replaces personal details it recognises by their shape before sending: email addresses, phone numbers, bank accounts and your own name. It doesn't always spot a name in the middle of a sentence. That is why n8n calls the traces pseudonymised, not anonymous.
Composio and Zero Data Retention. The default connection service uses Composio with Zero Data Retention switched on. For covered calls, Composio then writes neither the request, the response nor error text to its execution logs, but it does store the tool name, time and status, plus the access tokens that keep your apps connected. Files, trigger events and tool searches have their own rules; Composio removes uploaded files after 24 hours. For calls through Composio's managed OAuth apps, coverage requires Enterprise according to the docs. Which of your connections fall under that, the docs don't say; if in doubt, ask n8n. Nod connects Notion, Linear and n8n itself through their own MCP servers, and with a source install you can choose another trusted connection service.
Turning it off, and what that doesn't delete
You find both switches, "Share usage data" and "Share conversation traces", under Settings → Privacy & data. A server operator can turn both off for everyone.
- What turning off does: new sends stop. A send already in flight may still arrive.
- What turning off doesn't do: data already sent stays with n8n, including "About you" answers and a consented email address. You request deletion through "Send feedback".
- The first start: on a fresh desktop app profile, usage data can report the opening of the setup window before you reach the switch, according to the docs. Turning it off later doesn't recall that one event.
- Unsubscribing is not unlinking: the unsubscribe link in n8n's emails stops future emails but does not unlink your address from usage data.
Deleting data
- A memory: Settings → Memory, select the note, "Forget". You can also ask Nod to forget something.
- A Vault item: delete it in Vault; end a saved browser session with "Sign out".
- An app: disconnect it under Apps. The service itself may keep listing Nod until you remove the access there.
- Everything in the desktop app: "Remove all data" under Settings → Privacy & data deletes your profile, the private computer and unsent drafts. The app stays installed.
- Source install or server: stop it, then remove the data folder and Docker volumes.
The docs name two traps themselves: uninstalling the desktop app keeps its data. And you can't clear only the chat history yet, only everything at once. Records in n8n's connection service are removed through "Send feedback".
Approvals and the approval checker
Reads and drafts run directly. Any other app action only runs if your words, a schedule's instruction, a standing instruction or one of your rules covers it; otherwise Nod asks. A rule to ask first also applies to reads and drafts. Payments always need your approval. A confirmation applies to exactly one action with exactly those details and runs once.
For an action to run, the checker has to quote the words that allow it, and the server verifies that those words really exist. Whether they actually mean that action is still the model's judgement. Under Usage you see every action with the words that allowed it. n8n writes itself that the checker can be wrong in every mode, and that a probability threshold cannot guarantee safety. In 240 test decisions by n8n, GPT-6.1 Sol and Claude Opus 5.5 got every one right, while Claude Haiku 5.5 let 8 unsafe actions through. So pick a strong model if Nod acts for you.
Be careful with standing instructions: an instruction like "forward Ana's invoices" applies to every matching new email, according to the docs even one that only claims to come from Ana.
Vault, Docker socket and network firewall
Vault. The server enters passwords, one-time codes and cards into the website itself; the model never receives them. A login only goes into a field whose origin matches the saved website exactly. A one-time code that Nod asks for and that you send on its own in the chat is kept away from the model and out of the history, according to the docs. The docs are open about the limits: the server and the browser can read the secrets, and there is no separate key service. Any other secret you type into the chat is known to the model, which can enter it into a page. If you store an authenticator key in the Vault, anyone with access to your Vault can complete the two-step sign-in.
Docker socket. The workspace where Nod runs commands runs as an unprivileged user and has no Docker socket, no keys and no browser profiles. On a self-hosted server, the Compose file of version 0.7.6 passes the socket only to a small helper container. Whoever can use that socket effectively has root on the host, so the helper runs with a read-only file system, all Linux capabilities dropped and at most 128 MB of memory. Why that matters and what to watch on a server is in Nod Self-Hosted: AI Agent by n8n on Mac mini.
Network firewall. A separate firewall container blocks private and reserved IPv4 addresses for the workspace, including cloud metadata services, as well as external IPv6. The workspace only starts once this firewall is ready. Its DNS requests go to the public resolvers 1.1.1.1 and 8.8.8.8. The browser also reaches only public addresses, never your local network. These rules don't change the server's own connections to models and apps, and data can still leave Nod through the public internet.
Access token. Whoever has a server's token has full access to the assistant and all connected accounts. Access over the network requires the token and HTTPS.
Prompt injection
Nod treats everything it reads as data, not instructions. According to the docs, pages, emails, files and tool results cannot grant permission, and the check for an app action sees your words and the planned action, never the content read. The docs also say what this doesn't cover:
- No checker is immune to prompt injection.
- A deceptive website can mislabel a button or send a form to an address that doesn't say what it does.
- Nod writes learned skills from what it did and read; a page or email can shape such a skill, which then steers later tasks. A skill never grants permission.
- The check that scans emails for access codes reads up to 8,000 characters, the start and end of long emails, and can miss a code in the middle.
How such attacks work and how to protect an agent against them is covered in Prompt Injection: Protecting AI Agents.
Recommendations for businesses with customer data
- Start with test data. For the first weeks, connect test accounts and copies instead of real inboxes.
- A model with a contract. For customer data, use a model through the API of a provider you have a data processing agreement with, rather than a personal subscription. With OpenAI, the EU region helps as well. What applies to Claude is in Claude Privacy and GDPR: What Applies.
- Switches before first use. Usage data off, for everyone if you run a server; leave conversation traces off; no email address in onboarding.
- Keep app permissions tight. What Nod may do in an app is set by the provider's consent screen, and some grants cover an entire mailbox. Composio belongs on your list of recipients; Notion, Linear and n8n go through their own MCP servers.
- Remember web search. Search queries go to Exa or, with a ChatGPT plan, to OpenAI.
- Very sensitive data stays local. A local model on your own hardware keeps the model work in-house. Apps, web search and websites remain recipients all the same.
- Your own server instead of a laptop. Reachable only over HTTPS with a token; backups encrypted and kept off the server, together with the Vault key, without which the database cannot recover saved credentials.
- One person per Nod. According to the docs, one server belongs to one person; a shared assistant for the team is not part of the design.
- Use the Vault sparingly. Only save logins Nod really needs, and never type passwords into the chat.
- Read Usage. It lists every action with the words that allowed it.
What questions an agent raises when it looks into your inbox itself is collected in Claude Duet and GDPR: An Agent in Your Inbox; how I separate what an AI gets to see at all is in AI and Privacy: What the AI Gets to See. This is not legal advice. For your individual case, we can look at it together.
Frequently asked questions
What does Nod mean for GDPR?
That doesn't depend on Nod alone, but on which services you connect and how you configure them. Nod stores data on your computer or server. Recipients are the model provider, n8n's connection service with Composio, Exa for web searches, and n8n for usage data, which according to the docs is stored in the EU. According to the docs, your fixed "About you" answers and a consented email address also go to Customer.io in the US.
Does Nod send my messages to n8n?
Not with usage data, which is on by default; according to the docs it contains neither your messages nor Nod's replies. Nod only shares conversation traces with content if you turn them on, and then pseudonymised, in the EU and for 14 days.
Where does Nod store my data?
On the computer or server that runs Nod: in the desktop app in a private virtual machine and the app's data folder, with a source install or on a server in Docker volumes. On a server, anyone who administers it can read it.
How do I turn off usage data in Nod?
Under Settings → Privacy & data, switch off "Share usage data". That stops new sends but doesn't delete anything already sent; you request that through "Send feedback".
Does the model in Nod see my passwords?
Not if they are in the Vault: the server enters them itself, and the model only sees account names and status. A password you type into the chat, on the other hand, is known to the model.
Can I run Nod without any cloud services?
Not completely. With a local model, usage data switched off and no app connections through Composio, the circle gets small. But websites Nod visits and web search through Exa remain recipients, and the desktop app checks n8n for updates.
How to continue
Write down which data Nod should see and which never, and which recipient from the table above is acceptable for you. Then set the switches under Settings → Privacy & data before you connect the first account, and start with test data. How I build AI employees with clear permissions and approvals is something I show in my community Claude Practitioners.
