Security
How Compliance Platform protects access and data.
Compliance Platform applies security controls across authentication, organization workspaces, API keys, abuse prevention, and privacy. Below are the measures in place today, the service providers involved, and the documentation available for review.
Essential cookies
Authentication, session continuity, security checks, and routing.
Scoped access
Workspace membership and role checks before client operations.
API key handling
Plaintext shown only at creation or rotation; stored secrets are hashed.
No ad tracking
No advertising or marketing pixels; analytics runs only after consent.
Authentication
Email/password and OAuth sign-in use Supabase Auth. Account confirmation and recovery use dedicated authentication routes.
Workspace access
Users enter organization workspaces through membership and role checks. Admin and client surfaces are separated in the application.
API keys
API key workflows are designed so plaintext keys are shown only at creation or rotation time; stored records use hashed secrets and scoped organization metadata.
Abuse prevention
Cloudflare Turnstile is used on login, password recovery, and confirmation resend flows to limit automated abuse. Security events and request context are logged for troubleshooting and abuse review.
Infrastructure
The current service stack uses Vercel for the web app, Supabase for data, authentication, and storage, Resend for transactional email, and Cloudflare for DNS, content delivery, and network protection.
Privacy defaults
Analytics only with consent, no advertising tracking.
The public website measures visits with Google Analytics 4, and only after the visitor accepts the analytics category. Advertising storage, ad personalisation and Google Signals stay switched off. The platform application carries no analytics at all — only essential authentication, session and security cookies.
Transparency and documentation
The operating company, its registration number and its registered address are named in the Privacy Policy.
Privacy requests go to privacy@norvext.com, security reports to security@norvext.com, which is also published in security.txt.
Retention periods are published per plan, together with what the service deletes automatically and when.
The Data Processing Terms apply to every plan including Free, with 30 days notice before a new subprocessor starts processing and a 72-hour ceiling on breach notification.
We do not currently claim an independent security certification such as ISO 27001 or SOC 2. This page describes implemented controls, not a certification.