Nango

Nango gives a product three primitives for integrating with third-party APIs: managed OAuth/API-key auth with token refresh and credential storage for 1,000+ APIs (per the vendor's docs and README, verified against nango.dev/docs/integrations as of 2026-09-22: https://nango.dev/docs/integrations), a proxy that injects credentials and handles retries/rate limits for authenticated requests, and 'Functions' — TypeScript integration logic (sync, action, webhook) that Nango's AI builder can generate from a natural-language description and that runs on Nango's own execution runtime. This combination — auth plus a code-first runtime, rather than just a unified-schema API — is the product's core differentiator versus category peers that only offer one of the two.

Published on nango.dev/pricing (verified 2026-09-22): Free ($0/mo, hard-capped limits reset monthly), Pay-as-you-go ($50/mo minimum, which buys $50 of usage credits), and Enterprise (custom, adds self-hosting support, MSA/SLA, and commitment discounts). Usage is metered on three axes: connections (authorized end-user accounts) at $0.29/connection/month, compute time at $0.72/hour, and data transfer at $0.5/GB — all prorated. Free-tier limits are 10 connections, 10 compute-hours, and 10GB of data transfer per month. A Growth add-on (also disclosed on the pricing page) is $450/month and is required to unlock SAML SSO, a HIPAA BAA, and a 5-day SLA on requested integration delivery; Enterprise self-hosted support ships in 2 days.

Nango's source is published under the Elastic License 2.0 (confirmed against the LICENSE file in the repo: https://github.com/NangoHQ/nango/blob/master/LICENSE), which is source-available rather than OSI open source — it specifically forbids offering the software to third parties as a hosted/managed service. The vendor's own README and marketing copy nonetheless describe Nango as 'open source' and 'fully open source' throughout (nango.dev homepage, README), which is the vendor's characterization, not an independent one, given the license's field-of-use restriction. A free self-hosted deployment is available but is explicitly scoped by the vendor to auth and proxy only — sync, tool calls, webhooks, triggers, the MCP server, RBAC, MFA, and SAML SSO are Cloud/BYOC-only features not present in the free self-hosted build (per nango.dev/docs/guides/platform/free-self-hosting, verified 2026-09-22).

GitHub's security-advisories API lists six published advisories against NangoHQ/nango between 2026-08-26 and 2026-09-07 (https://api.github.com/repos/NangoHQ/nango/security-advisories, checked 2026-09-22): a critical SSRF (CVSS 9.9, GHSA-hgjm-c252-ccxx) where user-controlled connectionConfig values were interpolated unvalidated into more than 40 providers' token/proxy URLs, letting an attacker holding any Nango credential reach cloud metadata endpoints and internal network hosts; a high-severity unauthenticated SQL injection in the task orchestrator (CVSS 7.7, GHSA-8m28-9wcj-v8ww); two further high-severity SSRF variants (CVSS 8.5 and unscored, GHSA-fqr5-mf8g-p5m2 and GHSA-c6jh-v7p9-556w); and two medium-severity issues (a webhook-signature bypass and an RBAC bypass on flow-read routes). The advisory for the critical SSRF listed 'Patched versions: None' at publication and named all versions through v0.70.4 as affected. The repository's public release history shows tagged releases up to v0.71.10 as of 2026-09-22 (https://github.com/NangoHQ/nango/releases), well past v0.70.4, indicating the codebase has moved on from the vulnerable commit, but none of the six advisories in the API response carries an explicit 'patched_versions' entry confirming the exact fixed release, so a self-hosting buyer should verify the fix commit against their deployed version directly rather than assume patch-by-upgrade.

Nango Cloud is SOC 2 Type II certified with a report available through its Trust Center (trust.nango.dev), is GDPR-compliant via an automatic DPA, and offers a HIPAA Business Associate Agreement as part of the paid Growth add-on rather than by default (per nango.dev/docs/guides/platform/security, verified 2026-09-22). Credentials are encrypted at rest with AES-256-GCM under an AWS KMS-managed key, and the vendor publishes fairly granular detail on data retention windows, connection deletion (soft-delete immediate, hard-delete after 31 days), and RBAC role scoping — more technical specificity than most vendors put in a public security page.

Nango is a Y Combinator (Winter 2023) company that raised $7.5M in seed funding led by Gradient, with participation from Horizon, Y Combinator, and individual angels including Akshay Kothari (Notion) and John Kim (Sendbird), announced April 1, 2026 (https://nango.dev/blog/nango-raises-7-5m-led-by-gradient, verified 2026-09-22). The company states in that same post that it was already cashflow-positive and generating 'several million' in ARR before raising — a vendor claim, not independently verified. Total disclosed funding is $7.5M; Nango has not disclosed a valuation.

G2 lists Nango at 4.5/5 across roughly 66-67 reviews as of the most recent snapshots found (g2.com/products/nango/reviews, accessed via search snippet 2026-09-22 — direct fetch returned HTTP 403 and no working proxy was available this session, so the figure could not be re-verified against the live page). Reviewers cited in aggregator summaries praise ease of use and support responsiveness; no adverse independent review pattern was found. This review base is not large enough to treat as decisive either way.