How we protect data
Citizen, patient, employee and financial records are the most consequential data an institution holds. These are the controls we build every platform around.
Access control
- Permissions are role-based and enforced on the server, not just hidden in the interface.
- Each company’s data is isolated, and every request is checked against the organisation it belongs to.
- Administrator and accountant roles require a second factor at sign-in.
Sessions and credentials
- Sessions are held in signed, HTTP-only cookies that page scripts cannot read.
- Passwords are stored only as salted hashes.
Money handling
- Amounts are stored as integer minor units, so rounding never drifts.
- Pay runs and disbursements carry idempotency keys, so a retry cannot pay twice.
- Payment provider callbacks are rejected unless the signature verifies.
Audit
Sign-ins, pay-run approvals, disbursements and payslip access are written to an immutable audit trail that administrators and accountants can review.
Encryption
Data is encrypted in transit and at rest. Access to production systems is limited to the people who need it and is logged.
Vulnerability disclosure policy
We would rather hear about a weakness from you than from an incident. If you believe you have found a security issue in this site or in a platform we operate, email support@nobicel.com. This policy is also published in machine-readable form at /.well-known/security.txt, per RFC 9116.
What to send
- Where the issue is, and the steps to reproduce it.
- What an attacker could do with it, as far as you have established.
- How you would like to be credited, if you would like to be.
What we commit to
- We acknowledge every report within two working days.
- We give you an assessment and a remediation plan within ten working days.
- We keep you updated until it is closed, and confirm when the fix ships.
- We will not pursue legal action against research conducted in line with this policy.
What we ask
- Do not test against live customer data, and do not access records that are not yours.
- Do not run denial-of-service tests, spam, or social engineering against our staff or clients.
- Give us a reasonable window to remediate before disclosing publicly. We will agree a date with you.
- Where a platform belongs to a client institution, we will co-ordinate disclosure with them.
We do not currently run a paid bounty. We do credit reporters who want it, and we will say so plainly in the release note that carries the fix.