Skip to content
Log inNLRequest accessAccess Menu
Security

Security without
compromises.

Controlled access, encrypted traffic and an honest list of what is already there and what is still to come.

Schedule an introduction
Access and network

Every request checked.
We are honest about the rest.

Every request to a Noveu service goes through the gateway and is checked there: who you are and what you are allowed to do. Services run in their own networks behind firewalls. Monitoring runs through Prometheus, with alerting by push message and email. There is no 24-hour on-call and no security centre that watches around the clock.

Every request checked
Every request is authenticated and authorised, with one Noveu login through OpenID Connect. External traffic goes over TLS.
Least privilege
Users get only the rights they need, through roles.
Networks per service
Services run in their own Docker networks behind firewalls. Further segmentation is in the design phase.
Monitoring
Monitoring with Prometheus and alerting by push message and email; no 24-hour on-call.
Central access logging
Planned. The audit log per organisation can already be exported as CSV.
Encryption

What is encrypted.
And what is coming.

ENCRYPTION AT REST
  • Backups are stored in the Hetzner data centre in Falkenstein (Germany)
  • Backups have been stored encrypted since 30 September 2026
  • The disks themselves are not yet encrypted; we are not giving a date for that yet
  • Periodic restore tests (planned)
  • Key management service (KMS) (planned)
ENCRYPTION IN TRANSIT
  • TLS 1.2 or higher, TLS 1.3 is supported
  • Mutual TLS (mTLS) between services (planned)
  • HSTS enforced
  • Certificate pinning (planned)
ENCRYPTION END-TO-END
  • S/MIME for email, designed for NTA 7516 (in the design phase)
  • PGP and client-side encryption (not yet available)

Your data and backups are stored in Germany, in a Hetzner data centre in Falkenstein.

Incident Response

Ready for the
unexpected.

Detection
Via alerting
Monitoring with Prometheus and alerting by push message and email; no 24-hour on-call. Central access logging is planned.
Triage
Right after detection
The incident is categorised (P1 to P4) and the right team is activated.
Containment
As soon as possible
Affected systems are isolated to prevent further spread. A P1 incident takes priority over all other work.
Notification
Statutory deadline
We notify you of a data breach no later than 48 hours after discovery. As an organisation you report a significant incident to the NCSC yourself; our reporting process for that is in the design phase.
Recovery
As soon as possible
Recovery from backup. We do not give a fixed recovery time; whoever needs one agrees it in a contract. The availability target is in the SLA at /legal/sla.
Postmortem
Within 5 working days
Root cause analysis, lessons learned and improvement actions documented and shared.

Have you found a vulnerability in noveu.eu or in one of our services? Report it to security@noveu.eu. How that works and what you can expect from us is described in our vulnerability disclosure policy.

Supply chain security

We know what is in your
software.

Noveu builds its core stack on proven open-source infrastructure components (such as PostgreSQL and Stalwart). Dependencies are scanned continuously for vulnerabilities. For a current overview of sub-processors (including Cloudflare, Stripe and Mollie) we refer to /juridisch/sub-verwerkers (in Dutch).

Open-source infrastructure components where possible
Software Bill of Materials (SBOM), planned, on request
Dependency vulnerability scanning (GitHub Dependabot + osv-scanner)
Release mirroring before production rollout, planned
No proprietary US core software in the Noveu stack (sub-processors published at /juridisch/sub-verwerkers)
Security conversation

Want to discuss our security architecture?

Schedule a conversation →