Core principle: Your employee data never touches our servers. All workforce data is processed in your browser and discarded when you close the tab. A breach of Noveli infrastructure cannot expose your employee data.
Noveli is built on a zero server side data model for workforce information. CSV files and org chart data are loaded and processed entirely within your browser using client side JavaScript. Nothing is uploaded to our backend at any point. Our servers handle only authentication, workspace configuration, contract status, the enquiry records described below, and a count of how many people are in a loaded org.
All communication between your browser and Noveli's servers is encrypted using TLS 1.2 or higher. We enforce HTTPS across all endpoints and reject insecure connections.
User passwords are hashed using industry standard algorithms and are never stored in plain text. Authentication sessions are managed using short lived JWT tokens, verified against the identity provider's published signing keys on every request. Session data is scoped per user and cannot be accessed by other users.
Our database uses row level security to enforce strict tenant isolation. Each user can only access data belonging to their own workspace. Service level operations use a separate privileged role that is never exposed to end users or to any client application.
Contact form submissions from our website are stored in the EU region. Row level security is enabled on that table with no read policies, which means the table is unreadable by both anonymous and authenticated client sessions. It is written and read only by our backend service role. Submissions are rate limited per IP address, and all user supplied text is escaped before it is included in any notification we send ourselves.
When someone loads an org chart we record a single number: how many people were in the file. Alongside it we store which workspace and which signed in user performed the load, the type of source (a CSV upload, the sample data, or a saved scenario), and the timestamp.
A count is not employee data. No names, job titles, manager relationships, salaries, email addresses or any other field from your file is transmitted or stored. The number is used to check whether an organisation has outgrown the size band on its contract, so that the right band can be agreed at renewal rather than guessed at.
These records sit in the EU region with row level security enabled and no read policies, which means they are readable only by our backend service role and never by any client application. They are retained for the life of the account. If a load exceeds the contracted band we show a notice in the product; access is never blocked.
Noveli processes no payment data at all. There is no checkout, no card on file, and no payment processor in our stack. Subscriptions are invoiced directly and settled by bank transfer, so there is no cardholder data anywhere in our systems to protect or to lose.
Noveli runs on the following SOC 2 certified infrastructure providers:
Noveli itself is an early stage company and does not currently hold independent ISO 27001 or SOC 2 certifications. We are committed to pursuing formal certifications as we scale. If your procurement process requires a completed security questionnaire, contact security@noveli.io and we will work through it with you.
Internal access to production systems is restricted to authorised personnel only. Administrative functions require separate authentication beyond standard user credentials. All administrative actions are logged.
In the event of a personal data breach that poses a risk to user rights, Noveli will notify the relevant supervisory authority within 72 hours as required by GDPR Article 33, notify affected users without undue delay when the breach is likely to result in high risk per GDPR Article 34, and maintain an internal breach register as required by GDPR Article 33(5).
Because employee workforce data is never stored on our servers, a breach of Noveli infrastructure cannot expose your employee data.
If you discover a security vulnerability in Noveli, we ask that you report it to us responsibly before making it public. Contact security@noveli.io with a description of the issue and steps to reproduce it. We will acknowledge your report within 48 hours and work to resolve confirmed vulnerabilities promptly. We will not take legal action against researchers who act in good faith.
Responsible disclosure: security@noveli.io
Security questionnaires: security@noveli.io
Acknowledgment time: Within 48 hours