Security you can reason about
We take a straightforward, defensible approach to protecting your financial data. This page describes the measures actually built into NovaTech Finance today — no more, no less.
Password hashing with bcrypt
User passwords are never stored in plain text. They are hashed with bcrypt before being persisted.
Server-side sessions
Authentication uses server-side sessions with secure, httpOnly cookies — session state is not exposed to the browser.
Server-enforced authorization
Access control is enforced on the server for every request. The client cannot bypass permission checks.
Multi-tenant isolation
Each organisation’s data is isolated, and every request is scoped to the signed-in user’s organisation and permissions.
Input validation with Zod
Incoming data is validated against strict schemas, reducing the risk of malformed or malicious input.
Audit logging
Key changes are recorded so activity can be reviewed and traced after the fact.
DEMO / LIVE data isolation
Demonstration data is kept strictly separate from your live financial data, so exploring never touches real figures.
Secrets kept out of the codebase
Credentials and secrets are supplied through environment configuration and are never committed to the repository.
A note on compliance
We describe only the controls that are genuinely implemented in the product. NovaTech Finance does not currently claim any specific security certification or formal compliance accreditation. As the platform matures, this page will be updated to reflect any additional measures or accreditations that are put in place.
- Statements here reflect the product as built
- No certifications or compliance claims are implied
- Security posture will evolve and be documented here