Security at NovaHR
You are trusting us with ID numbers, salaries, and bank details. Here is exactly how we protect them.
Encryption everywhere. All traffic is encrypted with TLS. Data is encrypted at rest with AES-256, including backups.
Your company's data is isolated. Every record is separated per company at the database level with row-level security, enforced on every query, not just in application code.
Least-privilege access. Employees see only their own data; managers their team; admins their company. Internally, production access is limited to named engineers with multi-factor authentication, and support works through application tools, not raw database access.
Everything is logged. Payroll runs, approvals, role changes, and exports are recorded in an audit log your administrators can view.
Backed up daily. Automated daily backups with tested restore procedures. Recovery objectives are published in our SLA.
Built on certified infrastructure. NovaHR runs on Vercel and Supabase (both SOC 2 Type II), with transactional email via Resend.
Found a vulnerability? We welcome good-faith research: read our Vulnerability Disclosure Policy and email support@novabos.co.za with subject "SECURITY REPORT". We respond within 3 business days and will not pursue good-faith researchers.
Questions from your IT or security team? Request our security pack: support@novabos.co.za.