Business

Security and data protection

Version: technical-overview-2026-11-05
Effective date: Not established
Last updated: 2026-11-05

This is an informational technical overview based on the reviewed implementation. It is not a contractual schedule, certification or confirmation that every capability is active in production.

Scope

This overview describes measures present in the reviewed Nostium implementation. Effectiveness in your environment, organisational procedures and contractual arrangements require separate confirmation. No certification or availability guarantee is offered.

Identity, access and organisations

Nostium implements account authentication, roles and permissions. Integration management checks access to the relevant organisation and location. Web sessions are managed server-side. Public website CMS staff must set up two-factor authentication.

Connections and secrets

The applications support HTTPS and secure session cookies. Integration credentials containing secrets are stored in encrypted application fields and omitted from ordinary model output. These are selected controls; additional contractual or operational statements about storage encryption require confirmation.

Logging and review

Integration management records change history with permission checks and secret exclusion. The APIs contain Sentry error reporting with privacy filters. Log access, recipients and retention must be assessed in the relevant production environment.

Recovery, retention and deletion

The platform includes tools for backup, export, recovery verification and retention management. Some retention features are disabled by default. Applicable periods, recovery arrangements, execution and verification depend on the environment and agreed procedures; request the information applicable to your service from Nostium.

Security and privacy questions

Report a suspected security issue to info@nostium.com and identify it as a security report. Do not send passwords, tokens or unnecessary personal data. Use dataprotection@nostium.com for privacy questions. The applicable data processing agreement governs incident obligations; statutory notification duties continue to apply.

Use your browser’s Print command to print this page or save it as a PDF.