Trust
Security practices in place today
NOVA is designed to hold sensitive assurance material. This page describes the practices in place, not unverified claims or certifications.
What we protect
Customer workspaces contain evidence, policies, risk assessments and control details. The security model is built around keeping that material confidential, intact and available only to authorised people.
Tenant isolation
Each organisation's data is scoped to its own tenant. Controls, evidence, policies and reporting are not shared between tenants.
Role-based access
Permissions are role-based inside each tenant. Access can be scoped to functions such as evidence reviewer, control owner or auditor engagement.
Infrastructure
The service is built on managed cloud infrastructure with hardened defaults, network segmentation and least-privilege operational access.
Assurance workflow
Auditor Portal access is scoped to a specific engagement. External reviewers see only what the organisation releases for that engagement.
Practices
How security is operated
- Least-privilege access for operational staff
- Change management and deployment reviews
- Monitoring, logging and incident response process
- Regular review of dependencies and supply chain exposure
- Data retention aligned with customer agreements
No invented certifications
What we do not claim
We do not publish certification seals, audit reports or security attestations that Eredox has not obtained. When reports become available through a formal trust process, they will be shared with eligible customers under appropriate confidentiality terms.
NOVA assists with readiness and evidence management. Certification, attestation and regulatory conclusions remain with authorised independent, regulatory or customer-appointed parties.
Reporting
How to report a security concern
If you have discovered a security issue or have a concern about the NOVA service, contact us through the contact page or email the address listed there. We respond to genuine reports and coordinate disclosure responsibly.
See NOVA against your own compliance obligations
Start free to explore the workflow, or walk through your framework, evidence and reporting requirements with us.
NOVA supports the readiness decision. Final launch and risk decisions remain human decisions.