Data protection
Operational records are read inside the organization you signed in with. Database connections require TLS, and integration credentials are encrypted before they are stored.
TRUST
Your operation needs speed.It also needs trust.
See how Nortiq protects access, keeps each organization's data in its own context, and leaves a trail of critical actions.
Security
Security practices
Access controls
A person's role decides what they can view, edit or administer. That check runs on the server. In production, the session travels only over HTTPS, in a cookie page scripts cannot read.
Application security
Access is checked before data is returned. Sign-in limits repeated attempts to reduce abuse. This page does not publish the result of an external audit.
Infrastructure
The platform uses managed PostgreSQL, object storage with time-limited links, and Amazon SES for email.
Privacy & data
How information is handled
Separation by organization
CRM, Calendar, Workflow, Communications and Driver read records inside the organization's boundary. A request does not return another company's data.
Access management
Belonging to the organization does not open everything. Role, and project membership where it applies, narrow what each person can do.
Information handling
Production secrets are supplied by the runtime environment, not stored in the application repository. Private files are not published at a permanent URL.
Privacy principles
We separate each organization's context, limit access by role and record important actions. This page describes those practices. It is not a legal certification.
Control & traceability
Visibility into what changes
Roles & permissions
Roles such as owner, admin, instructor or read-only set the scope. The check is enforced on the request, not only in the interface.
Action history
Important CRM actions are stored with the person, the action and the record. Communications records delivery events and administrative changes.
Audit
An administrator reviews those records inside their organization. We do not claim that every product logs every click.
Operational visibility
The point is to see critical changes: who did what, on which record: when the team needs to review a decision or a follow-up.
Reliability
What the operation rests on
Cloud architecture
Products run on managed cloud services, with an encrypted connection to PostgreSQL, object storage and Amazon SES for email.
Backups & retention
Academy includes backup routines. Calendar applies retention policies to calendar data. We do not publish one recovery commitment for the whole platform.
Operational continuity
The operation relies on that cloud infrastructure. This site does not publish an availability percentage or a certified continuity plan.
Responsible intelligence
Intelligence with control.
Intelligence should help people spend less effort on manual work. Control stays with people, with permissions and with each organization's boundary.
People keep control
An intelligent assist can organize or speed up the work. It does not replace the operator's decision.
Permissions decide access
No one sees more than their role allows, even when a function helps summarize or suggest a next step.
Data stays inside the organization
One company's information stays in its own context. It is not mixed with another's.
We describe what exists
We describe practices the product supports today. We do not announce agents or intelligence features that are not published.
Security questions
- How does Nortiq separate data between companies?
- Operational records are read inside the organization you signed in with. A request does not return another company's data.
- How are permissions controlled?
- Each person has a role. That role decides what they can view, edit or administer, and the check runs on the server.
- Who can access the information?
- People in that organization whose role allows it. In production, the session travels only over HTTPS, and the session cookie is not readable by page scripts.
- Does Nortiq keep audit records?
- Important actions are recorded with the person, the action and the record. Those records are read inside the same organization. We do not claim that every product logs every click.
- How are communications protected?
- Email is delivered with Amazon SES. Database connections require TLS. Integration credentials are encrypted before storage, and private files can be shared with time-limited links.
- Where can I request more security information?
- Write to [email protected]. This page describes practices we can stand behind. It does not replace a review with your team.
Does your team need to review our security architecture?
Write to us. We answer evaluation questions. There is no form on this page.
Email[email protected]