🎉 New: QR Code Payments are now live — Try it free today →
Skip to main content
Legal & Compliance

Security Policy

This document describes the technical and organizational security measures Nobevra implements to protect your business data, financial records, and account information.

1. OUR SECURITY COMMITMENT

Nobevra is built on the principle that users who trust us with their business data deserve robust, transparent, and independently verifiable security practices.

This Security Policy describes the technical and organizational measures Nobevra implements to protect the confidentiality, integrity, and availability of the Service and of Business Data entrusted to us.

Effective Date: August 8, 2026
This document reflects the security posture as of the effective date. Specific controls are subject to change as the platform evolves.

2. INFRASTRUCTURE SECURITY

Cloud infrastructure: Nobevra's backend is hosted on Supabase, which runs on AWS infrastructure. Web application delivery is handled by Vercel's global edge network.

Physical security: Nobevra does not operate its own data centers. Physical security controls — including perimeter security, access controls, surveillance, and environmental controls — are managed by AWS and Vercel in accordance with their respective certifications (AWS SOC 2, ISO 27001, and related standards).

Network security:

  • All traffic between clients and Nobevra servers is encrypted using TLS 1.2 or higher.
  • Edge-layer DDoS protection and rate limiting are implemented via Supabase and Vercel's infrastructure.
  • Database and storage access is restricted to authorized server-side processes; the database is not publicly accessible.
  • Production systems are logically isolated from development and staging environments.

Supabase security: https://supabase.com/security
Vercel security: https://vercel.com/security

3. ENCRYPTION

In transit:

  • All connections between clients (browsers, mobile apps) and Nobevra servers use TLS 1.2+.
  • HTTP connections are automatically redirected to HTTPS.
  • Supabase database connections use encrypted connections.

At rest:

  • Database data is encrypted at rest by Supabase/AWS (AES-256).
  • Document and file storage is encrypted at rest.
  • Mobile application secrets (JWT tokens, user credentials) are stored using flutter_secure_storage, which uses:
    • iOS: Keychain Services (hardware-backed where available)
    • Android: EncryptedSharedPreferences (backed by Android Keystore)

Passwords:

  • User passwords are never stored in plain text.
  • Password hashing is managed by Supabase Auth using bcrypt.

4. AUTHENTICATION

Methods supported:

  • Email and password (with password-strength enforcement)
  • Google OAuth 2.0 (Sign in with Google)
  • LinkedIn OAuth (if social features are connected)

Session management:

  • Authentication uses JWT (JSON Web Tokens) issued by Supabase Auth.
  • Access tokens are short-lived (typically 1 hour).
  • Refresh tokens rotate on use, limiting the impact of token exposure.
  • Sessions can be invalidated server-side on sign-out or account security events.

Mobile push notification security:

  • Firebase Cloud Messaging (FCM) device tokens are stored in the database and associated with authenticated user accounts.
  • FCM tokens are used only for sending legitimate platform notifications to your devices.
  • Tokens are rotated on re-registration and cleaned up on sign-out.

5. ROW-LEVEL SECURITY (RLS)

Nobevra implements Supabase Row-Level Security (RLS) policies across all database tables containing user data.

RLS ensures that:

  • A user can only read, insert, update, or delete rows that belong to their own account or Workspace.
  • Database queries cannot return data belonging to another user, even if an unauthorized query is attempted.
  • Team workspace access is governed by role-based RLS policies — members can access only the Workspace data their administrator has authorized.

RLS is enforced at the database level, independent of application-level access controls, providing an additional security layer.

6. ACCESS CONTROL

User-level:

  • Access to features and data is controlled by your subscription plan entitlement.
  • Entitlement checks are enforced at both the API and database levels.

Team workspace (Noble Elite):

  • Workspace administrators can assign roles and permissions to team members.
  • Role-based access control (RBAC) limits what data each team member can view, create, or modify.
  • Administrators can remove members and revoke access at any time.

Nobevra staff access:

  • Nobevra staff do not have routine access to user Business Data.
  • Access may be necessary for support, security investigations, or legal compliance, and is subject to internal access control policies.

API keys:

  • API keys (Noble Elite) are hashed before storage. Full API keys are displayed only at the time of creation.
  • Lost API keys cannot be recovered — a new key must be generated.

7. DATA SECURITY

Data isolation: Every user's data is logically isolated by user ID and, for teams, by Workspace ID. RLS policies (Section 5) enforce this isolation at the database level.

Audit logging: Critical account actions — including sign-in events, subscription changes, team membership changes, and data deletion requests — are logged for security and compliance purposes.

GDPR/NDPA-relevant controls:

  • The database includes GDPR-compliance columns (consent records, data deletion flags, retention tracking).
  • The cleanup-user-data Supabase Edge Function implements a structured, cascading deletion pipeline for account deletion requests.
  • Soft-deletion mechanisms are used where immediate hard deletion is not feasible (e.g., financial records subject to retention obligations).

AI data handling:

  • AI assistant, OCR, and report insight features use Google Gemini API.
  • Data submitted to the Gemini API is not used to train Google's general-purpose AI models (per Google's API terms).
  • The content of AI sessions is not stored in the Nobevra database — only usage counts are recorded.

8. PAYMENT CARD SECURITY

Tokenized-only architecture: Nobevra uses a tokenized payment architecture designed to minimize exposure to cardholder data:

  • Card numbers, CVVs, and full card details are submitted directly to Flutterwave's PCI DSS-compliant hosted environment and never transit Nobevra application servers.
  • Nobevra stores only the payment token returned by Flutterwave: last 4 digits, card brand, expiry reference, and transaction identifiers.
  • This architecture is designed to reduce Nobevra's PCI DSS scope.

Flutterwave PCI DSS compliance: https://flutterwave.com/us/compliance

9. BACKUPS

Database backups: Supabase maintains automated database backups on a schedule consistent with its platform commitments. Backup retention periods are governed by Supabase's policies for the applicable service tier.

File/document storage: User-uploaded documents and files stored in Supabase Storage are protected by Supabase's storage infrastructure, including redundant storage.

User-initiated exports: Where available, Nobevra provides data export functionality to allow users to maintain independent copies of their Business Data. We recommend using this functionality for critical business records.

Nobevra's backup systems are designed for disaster recovery and are not a substitute for your own business continuity arrangements for critical financial records.

10. MONITORING

Nobevra implements the following monitoring controls:

  • Error and performance monitoring: Application errors, API failures, and performance anomalies are monitored.
  • Authentication monitoring: Failed sign-in attempts and unusual session patterns may trigger security alerts.
  • Rate limiting: API endpoints and authentication systems implement rate limiting to mitigate brute-force and abuse attempts.
  • Third-party monitoring: Supabase and Vercel provide infrastructure-level monitoring including availability alerting.

11. INCIDENT RESPONSE

In the event of a security incident affecting user data:

  1. Detection and containment: Affected systems are isolated to limit the impact.
  2. Assessment: The nature, scope, and affected data are determined.
  3. Notification: Affected users and, where required, relevant supervisory authorities (including the NDPC under NDPA 2023, and other applicable regulators) are notified within applicable legal timeframes. Under GDPR, personal data breaches must generally be reported to the relevant supervisory authority within 72 hours of becoming aware.
  4. Remediation: The vulnerability or cause of the incident is addressed.
  5. Post-incident review: Lessons are incorporated into security controls.

To report a suspected security incident or data breach: privacy@noblesworld.com.ng

12. VULNERABILITY MANAGEMENT

Nobevra operates a responsible disclosure approach to security vulnerabilities:

If you discover a security vulnerability:

  • Please report it to privacy@noblesworld.com.ng with a description of the issue and steps to reproduce.
  • Do not publicly disclose the vulnerability until we have had a reasonable opportunity to investigate and remediate.
  • Do not exploit the vulnerability beyond what is necessary to demonstrate its existence.
  • Do not access, modify, or delete data belonging to other users during your testing.

We will acknowledge your report promptly and aim to resolve confirmed vulnerabilities in a timely manner. We do not currently operate a formal bug bounty programme, but we genuinely appreciate responsible disclosure and will acknowledge researchers who help us improve security.

You must not conduct security testing against Nobevra systems without prior written authorization.

13. YOUR RESPONSIBILITIES

Security is a shared responsibility. To protect your Nobevra Account:

  • Use a strong, unique password for your Nobevra account that you do not reuse on other services.
  • Enable Google Sign-In or other available authentication methods where they offer additional security.
  • Protect your API keys — do not commit them to public repositories or expose them in client-side code.
  • Manage team access carefully — remove former employees or contractors promptly.
  • Keep your contact information current — we use your email address for security notifications.
  • Report suspicious activity immediately to invoice@noblesworld.com.ng.
  • Maintain independent backups of critical business records.

Nobevra is not responsible for security incidents caused by your failure to follow reasonable security practices.

14. CONTACT

Security and vulnerability reports: privacy@noblesworld.com.ng
Data Protection Officer: privacy@noblesworld.com.ng
General support: invoice@noblesworld.com.ng

For data-subject rights requests related to security data, please contact the Data Protection Officer.

The Noble's Technology Services

© 2026 Nobevra. A product of The Noble's Technology Services. All rights reserved.