Noxtill holds the operating record of a business — its customers, its takings, its credit ledger, its messages. If that is exposed, the harm does not fall on us; it falls on a salon owner whose client list is in the open, and on the clients in it.
That shapes how we build. The controls below are not aspirations. Where something is not yet in place, this page says so rather than implying otherwise.
| Control | Implementation |
|---|---|
| Hosting location | Production infrastructure is located in the United States. We do not currently offer data residency in another territory. |
| Network isolation | Application and database tiers are separated. Databases are not reachable from the public internet; access is through a private network. |
| Edge protection | DNS, CDN, DDoS mitigation and a web application firewall sit in front of the application. |
| Encryption in transit | TLS 1.2 or above for every connection, with modern cipher suites and HSTS. Internal service traffic is encrypted. |
| Encryption at rest | Databases, object storage and backups are encrypted at rest. |
| Secrets | Credentials and API keys are held in a managed secrets store with rotation. Secrets are never committed to source control or embedded in client code. |
| Segregation of environments | Production, staging and development are separate. Production data is never copied into a non-production environment. |
Every business that uses Noxtill is a separate tenant. Isolation is enforced at the data-access layer, not in page logic: every query carries the identity of the account that issued it, and a query that does not carry one does not execute.
This matters because the most common way multi-tenant software leaks is a single endpoint where a developer forgot the account filter. Enforcing it below the application makes that class of mistake structurally difficult rather than relying on review to catch it.
Cross-tenant isolation is covered by automated tests that attempt access across accounts, across branches, through the API, through realtime subscriptions and through object storage, and that fail the build if any of them succeed.
| Control | Implementation |
|---|---|
| Authentication | Password with strength requirements, or single sign-on where your plan includes it. Credentials are hashed with a modern memory-hard algorithm. |
| Multi-factor authentication | Available on every account. We strongly recommend it on every user with administrative rights. |
| Session management | Server-side sessions with expiry, revocation on password change, and a visible list of active sessions you can end. |
| Role-based permissions | Authorisation is checked server-side on every request. Hiding a control in the interface is not treated as security. |
| Field-level restrictions | Sensitive fields — cost, margin, salary, bank details, customer contact data — can be restricted independently of the screens that display them. |
| Our own access | Staff access to customer data is limited to support you have requested, a security investigation, or a legal obligation. It is time-bounded, logged, and reviewed. We do not browse customer data. |
- Input validation and parameterised queries throughout; no string-built SQL.
- Output encoding and a content security policy to limit cross-site scripting.
- CSRF protection on state-changing requests.
- Rate limiting on authentication, the API and expensive operations.
- Signed webhooks, with signature verification and replay protection.
- Idempotency keys on operations that move money or send messages, so a retry cannot duplicate the effect.
- Dependency scanning on every build, with alerts on known vulnerabilities.
- Code review before merge; no direct commits to the production branch.
- Static analysis and secret scanning in the pipeline.
We log authentication events, administrative actions, permission changes, data exports, access to recordings and transcripts, and every create, update and delete of a business record with the actor and the before-and-after state.
Audit records are append-only. They are retained for at least twelve months, and longer where an investigation requires it.
Alerting covers failed authentication spikes, unusual export volume, webhook signature failures, privilege changes, infrastructure anomalies and spend thresholds.
| Severity | Target remediation |
|---|---|
| Critical — remote code execution, authentication bypass, cross-tenant data access | Within 24 hours of confirmation. |
| High — privilege escalation, significant data exposure | Within 7 days. |
| Medium | Within 30 days. |
| Low | Within 90 days, or deferred with a documented rationale. |
Dependencies are monitored continuously and patched on the same schedule, prioritised by exploitability in our context rather than by score alone.
We maintain a documented incident response plan with defined severities, an on-call rotation, and a communication path to affected customers. The plan is exercised periodically.
| Stage | What happens |
|---|---|
| Detect | Alerting, customer report, or researcher report to security@noxtill.com. |
| Contain | Limit the blast radius — revoke credentials, isolate a component, disable an endpoint. |
| Assess | Determine what data was affected, whose, and how. |
| Notify | Affected customers without undue delay and in any event within 72 hours of confirming a breach, with what we know, what we are doing, and what you need for your own notifications. |
| Remediate | Fix the cause, not only the symptom. |
| Review | A written post-incident review, with actions tracked to completion. |
Where we act as processor, we notify the controlling business — not their customers — because the duty to notify those individuals is the business's, and they hold the relationship.
| Item | Commitment |
|---|---|
| Backups | Continuous, encrypted, retained 30 days. |
| Restore testing | At least quarterly. |
| Recovery time objective | 4 hours for a full-service outage. |
| Recovery point objective | 1 hour of data. |
| Your own continuity | Export regularly. Backups are our disaster-recovery measure, not your archive. |
- Background checks before production access is granted, where lawful in the individual's jurisdiction.
- Confidentiality obligations in every employment and contractor agreement, surviving the engagement.
- Security training at induction and annually.
- Least-privilege access, reviewed on role change and revoked on departure.
- Device requirements — disk encryption, screen lock, managed updates — for anyone with production access.
We assess a vendor's security before engaging it, require contractual data protection obligations at least as protective as our own, and review the arrangement periodically. The current list, with each one's role and processing location, is at https://noxtill.com/subprocessors.
We remain fully liable to you for a sub-processor's handling of your data. "Our vendor did it" is not a defence we will offer you.
| Said plainly |
|---|
| We do not currently hold SOC 2 Type II, ISO 27001 or any equivalent third-party attestation. The controls on this page are real and are the ones we operate, but they have not yet been audited by an independent assessor. If your procurement process requires an attestation today, we are not yet able to meet it, and we would rather tell you that now than during your review. |
We are able to complete a security questionnaire, provide architecture detail under NDA, and discuss contractual commitments. Contact security@noxtill.com.
Report to security@noxtill.com. We aim to acknowledge within 2 business days and to give you a remediation timeline within 10 business days.
We will not pursue legal action against a researcher who acts in good faith, stays within the scope of our Vulnerability Disclosure Policy, does not access or exfiltrate another customer's data, does not degrade the Service, and gives us reasonable time to remediate before disclosure.
We do not currently operate a paid bug bounty. We credit researchers who ask to be credited.
| Purpose | Contact |
|---|---|
| Vulnerability reports | security@noxtill.com |
| Suspected account compromise | security@noxtill.com |
| Security questionnaires and due diligence | security@noxtill.com |
| Privacy and data protection | privacy@noxtill.com |
| Sub-processor list | https://noxtill.com/subprocessors |