Security

Security is built into Nodary rather than bolted on. We follow the principles of least privilege, defence in depth, and secure-by-default configuration, and we keep the attack surface small by relying on managed, audited infrastructure. This page summarises the measures in place; our handling of personal data is described in the Privacy Policy.

Nodary runs entirely on Amazon Web Services, whose data centres hold leading independent certifications, including SOC 2 Type II and ISO 27001.

• The database runs on managed PostgreSQL inside a private virtual network (VPC), not exposed to the public internet.
• Compute runs on isolated, ephemeral serverless functions with scoped IAM permissions.
• Files are stored in access-controlled object storage with signed, time-limited URLs.

• Passwords are hashed with bcrypt; we never store them in plain text and never display them back.
• Sessions use signed, http-only tokens with per-session and “sign out everywhere” revocation.
• Optional two-factor authentication (TOTP) with backup codes and replay protection.
• Role-based access control within each workspace, enforced on the server for every request, not just hidden in the interface.
• Email verification, constant-time token checks, and single-use links for verification and password reset.

• Encryption in transit (TLS) for all connections.
• Encryption at rest for the database, file storage and backups.
• Strict per-workspace data isolation, enforced on every query and at the billing and AI layers.
• Automated, encrypted backups with point-in-time recovery on the managed database.

AI features run on foundation models hosted within AWS (Amazon Bedrock) under an agreement that prohibits using your data to train their models.

• Server-side input validation with schema enforcement.
• Layered rate limiting on authentication, API and AI endpoints, both in-memory and distributed.
• Content Security Policy and standard hardening response headers.
• Audit logging of sensitive actions, and visible active-session management for every user.
• Webhooks are signature-verified and processed idempotently to prevent replay.

Payments are handled by Stripe, a certified PCI-DSS Level 1 service provider. Card data is entered directly with Stripe and never touches our servers; we store only non-sensitive billing metadata.

If you believe you have found a security vulnerability, please report it privately to francois@anklebreaker-studio.com with enough detail to reproduce it. We will acknowledge your report, investigate promptly, and keep you informed. Please give us a reasonable opportunity to remediate before any public disclosure, and do not access or modify data that is not yours.

In the event of a personal-data breach, we will notify the relevant supervisory authority and affected users within the timeframes required by the GDPR, and we will act to contain and remediate the incident.