Security

Our approach

Your spreadsheets describe what you import. We treat them as confidential business data. This page says plainly what we do, and what we do not claim.

Encryption

• All traffic between you and Nomenwise uses HTTPS (TLS).
• Uploaded files and results are encrypted at rest (AES-256) in Cloudflare storage.

Access and sharing

• Result downloads use private links that expire after 7 days.
• Access to your data is limited to the people who need it to run or support the Service.
• We keep data only as long as stated in the Privacy Policy, then delete it.

Your data and AI

We do not use your files to train models without your agreement. Providers that process product text for us are bound by contract not to train on it.

Logs

We redact personal data from logs and do not write full email addresses to them.

Infrastructure

Nomenwise runs on Cloudflare and a virtual private server. We use well-known providers for hosting, storage and email, and list them in the Privacy Policy.

Protection against abuse

Sign-up and contact forms are rate limited and screened for automated abuse. Uploads are limited by type and size.

Certifications

We do not yet hold SOC 2 or ISO 27001 certification. We will say so here when that changes.

If something goes wrong

If a breach affects your data, we will tell you without undue delay and notify authorities where the law requires it, including within 72 hours under the GDPR where it applies.

Report a vulnerability

If you find a security problem, write to [email protected]. Please give us reasonable time to fix it before sharing details, and do not access data that is not yours or disrupt the Service. We will not take legal action against good-faith research that follows these rules, and we will reply promptly.