01Security Commitment
Nordath protects the confidentiality, integrity and availability of its customers' data. Traffic is encrypted with TLS, the application and database run in the EU, sessions are signed server-side, each organisation's data is isolated and access within it follows team roles, API keys can be revoked at any time, staff tools are protected by Cloudflare Access, and analytics are cookie-less and consent-based.
02Vulnerability Reporting
We welcome reports from ethical security researchers. If you find a vulnerability in nordath.com, partners.nordath.com, portal.nordath.com or our API, report it to [email protected]. Our contact details and preferences are in our RFC 9116 file at nordath.com/.well-known/security.txt.
03Our Commitments After a Report
When we receive a report, we will: - Acknowledge it within 24 hours. - Give an estimated timeline for the fix. - Fix verified issues and keep you informed until they are resolved. Please give us reasonable time to fix a vulnerability before disclosing it publicly.
04Safe Harbour
Nordath will not take legal action or suspend access for research carried out in good faith, provided you do not access more data than needed to show the issue, do not modify or destroy data, do not disrupt our services and do not target other customers' accounts.