1. Our approach
Customer Data is hosted on Cloudflare's infrastructure with a Western North America location. It may be stored and processed in the United States or Canada. Each firm's data is kept separate from every other firm's. We follow a defence-in-depth approach: multiple layers of controls so that no single failure compromises the security of customer data. We do not publish low-level implementation details that would be useful to attackers; this page summarizes the controls customers most often need to assess.
2. Encryption
- In transit: all traffic to the platform is encrypted using current industry-standard TLS. Older TLS versions are not accepted. HTTP Strict Transport Security is enforced on all production hostnames.
- At rest: customer data is encrypted at rest.
- Drive files: files in a case's drive get a second layer of encryption, with a key that belongs to that firm.
- Backups: backups are encrypted at rest and during transfer.
- Mobile cache: Aurora uses platform-provided secure storage for cached data and credentials.
3. Identity and access
- Two-factor sign-in for staff.
- Role-based access controls and least-privilege defaults.
- Session controls: idle timeout and forced re-authentication on sensitive actions.
- Periodic access reviews for Nova System personnel; immediate revocation on role change or departure.
4. Network and infrastructure
- Production network is segmented from corporate and pre-production environments.
- Default-deny ingress, with allow-listing limited to what the Service requires.
- Distributed denial-of-service mitigation and a web application firewall at the edge.
- Rate limiting and bot management on public surfaces.
- Hardened images and immutable infrastructure where supported.
5. Application security
- Secure software development lifecycle with code review for all changes that affect production.
- Static analysis, dependency scanning, and secret scanning integrated into our build pipeline.
- Threat modelling and design review for material new features.
- Coordinated vulnerability disclosure process; report findings to security@thenovasystem.com.
6. Logging, monitoring, and audit
- Security-relevant events are logged centrally with integrity protection.
- Each firm has an activity log of actions inside the platform, and can export it from Polaris.
- Audit-log retention aligned to compliance requirements.
7. Vulnerability management
- Scheduled patching with expedited response for critical CVEs.
- Dependency updates governed by automated tooling and review.
8. Personnel security
- Confidentiality undertakings signed at onboarding.
- Documented off-boarding that revokes access and recovers assets.
9. Vendor and sub-processor governance
We perform diligence on sub-processors, contractually require flow-down obligations, and review them periodically. The current sub-processor list is at /legal/sub-processors. Where required by law, additions follow the advance-notice and objection process in the DPA.
10. Resilience, backups, and disaster recovery
- We take hourly snapshots of the database and the key-value store, and the database can be restored to any minute in the last 30 days. Uploaded documents are not covered by these backups.
- Documented business continuity and disaster recovery plans aligned to defined recovery objectives.
11. Incident response
We maintain documented incident-response runbooks. On confirmation of a Personal Data Breach affecting a customer, we notify the customer without undue delay as set out in the DPA. The notification will, as it becomes known, describe the nature of the incident, the categories and approximate number of records affected, and the measures taken or proposed. Customers may report suspected incidents at security@thenovasystem.com.
12. Mobile and endpoint considerations
- Aurora and Polaris rely on platform-provided security features (secure enclave, code signing, sandbox).
- Biometric unlock is available where supported by the device.
- Remote sign-out by an administrator is supported.
- Sensitive actions require recent re-authentication.
13. Data handling principles
- Data minimization: we collect only what we need to operate the Service.
- Purpose limitation: we use customer data to deliver and improve the Service, with the restrictions described in the Privacy Policy and DPA.
- No training on customer data: we do not train any model on customer data without explicit opt-in or irreversible de-identification.
- Retention: defined retention schedules, with secure deletion at end-of-life.
14. Compliance attestations
See the Compliance Attestations page for current attestation status and the regulatory frameworks we align with.
15. Reporting security issues
To report a vulnerability or suspected incident, email security@thenovasystem.com with reproduction steps and impact. We will acknowledge within one business day. Please give us reasonable time to remediate before public disclosure.
16. Contact
Security questions: security@thenovasystem.com. Privacy questions: privacy@thenovasystem.com.