Security

Novato handles licences, insurance certificates, safety records and other compliance-sensitive documents, so security is core to how we build the product. This page describes the practices we currently have in place. If you have a specific security question as part of a vendor review, contact us at support@novato.com.au.

1. Data encryption

All traffic to and from Novato is encrypted in transit via TLS. Data at rest, including uploaded documents, is encrypted at the infrastructure level by our database and storage provider, Supabase.

2. Access control

We use row-level security policies at the database layer so that a customer's data, including worker records and documents, is only ever reachable by that customer's own account and the people associated with it. Inside a company, a person sees only the projects they are assigned to. Administrative access to production data is restricted to authorised personnel and used only where necessary to operate or support the service.

3. Files

Every uploaded file is scanned for malware before anyone can open it. A file that does not pass the scan is blocked.

4. Audit trail

Every change to a record is written to an audit log that records who made it and when. Records that are signed off are locked, and a later correction is added as an amendment with a reason, so the original stays readable.

5. Documents sent for reading

Documents you ask Novato to read or use as the basis for a draft are sent over encrypted connections to our AI provider, Anthropic. They are not used to train AI models. See our AI Policy.

6. Payments

We never store full payment card numbers. All billing is handled directly by our payment processor, Stripe, a PCI-DSS compliant payment processor.

7. Infrastructure and subprocessors

• Supabase: database, authentication, and file storage.
• Stripe: subscription billing and payment processing.
• Anthropic: AI-assisted document reading and drafting.

8. Backups and availability

Our database provider maintains regular automated backups. We monitor the platform for availability issues and work to resolve incidents promptly.

9. Vulnerability reporting

If you believe you have found a security vulnerability in Novato, please report it to support@novato.com.au. Please give us a reasonable opportunity to investigate and address any issue before disclosing it publicly, and avoid accessing or modifying data that is not your own while testing.

10. Compliance certifications

Novato does not currently hold formal certifications such as ISO 27001 or SOC 2. We are a growing platform and are building our security program in line with the size and risk profile of the business. We would rather state that plainly than imply otherwise.

11. Contact us

Questions about Novato's security can be sent to support@novato.com.au.