Skip to content
Get started

Security Policy

Last updated: February 1, 2026

Our commitment

At Novitora, security is not an afterthought — it is a foundational principle embedded in every aspect of our platform. We are committed to:

  1. Protecting user data against unauthorised access, disclosure, alteration, and destruction.
  2. Maintaining a robust information security programme that evolves with emerging threats.
  3. Complying with applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the EU General Data Protection Regulation (EU GDPR).
  4. Providing transparency about our security practices so you can make informed decisions about using our services.
  5. Continuously improving our security posture through regular assessments and updates.
  6. Fostering a culture of security awareness among all employees, contractors, and partners.

We believe that trust is earned through consistent action. This policy outlines the specific measures we take to protect your data throughout its entire lifecycle on our platform.

Information security programme

Programme overview

Novitora maintains a comprehensive Information Security Management System (ISMS) that is designed to identify, assess, and mitigate risks to the confidentiality, integrity, and availability of information assets. Our programme is aligned with industry best practices, including ISO/IEC 27001 principles and the NIST Cybersecurity Framework.

Governance structure

  1. Security Leadership: Our security programme is overseen by a dedicated security team led by a senior member of our engineering leadership.
  2. Risk Management: We conduct regular risk assessments to identify and prioritise potential threats to our systems and data.
  3. Policy Framework: We maintain a suite of internal security policies, standards, and procedures that govern all aspects of our operations.
  4. Board Oversight: Security matters are reported to the company's leadership on a regular basis, ensuring executive-level visibility and accountability.

Security objectives

Our information security programme is designed to achieve the following objectives:

  1. Protect user files during upload, conversion, download, and storage.
  2. Ensure that file conversion processes do not introduce vulnerabilities or data leakage.
  3. Maintain the availability and reliability of our conversion services.
  4. Detect and respond to security incidents promptly and effectively.
  5. Comply with all applicable legal and regulatory requirements.
  6. Provide users with confidence that their data is handled securely.

Data encryption

Encryption at rest

All data stored on our systems is protected using strong encryption algorithms:

  1. Storage Encryption: User files and associated metadata stored on our servers are encrypted using AES-256 (Advanced Encryption Standard with 256-bit keys), which is widely regarded as one of the most secure encryption standards available.
  2. Database Encryption: All databases containing user information employ transparent data encryption (TDE) to protect data at the storage level.
  3. Key Management: Encryption keys are managed through a dedicated key management system with strict access controls. Keys are rotated on a regular schedule and are never stored alongside the data they protect.
  4. Backup Encryption: All backup copies of data are encrypted to the same standard as production data, ensuring protection even in disaster recovery scenarios.

Encryption in transit

All data transmitted between your devices and our servers is protected using industry-standard encryption protocols:

  1. TLS 1.2/1.3: All connections to our platform are secured using Transport Layer Security (TLS) version 1.2 or higher. We support TLS 1.3 as the preferred protocol.
  2. Certificate Management: We use certificates issued by trusted Certificate Authorities (CAs) and monitor their validity and integrity.
  3. HTTP Strict Transport Security (HSTS): Our platform enforces HSTS to prevent protocol downgrade attacks and ensure that all communications occur over HTTPS.
  4. Forward Secrecy: We implement perfect forward secrecy (PFS) to ensure that the compromise of a long-term key does not compromise past session keys.
  5. API Encryption: All API communications, including those with third-party integrations, are encrypted using TLS.

File processing encryption

During the file conversion process, additional protections are in place:

  1. Uploaded files are encrypted immediately upon receipt by our servers.
  2. Files in the conversion pipeline are processed in isolated, encrypted environments.
  3. Converted files are encrypted before being made available for download.
  4. Temporary files created during the conversion process are securely deleted after processing is complete.

Access controls

Authentication

We implement robust authentication mechanisms to ensure that only authorised individuals can access our systems and data:

  1. Multi-Factor Authentication (MFA): MFA is required for all internal system access, administrative panels, and critical infrastructure components.
  2. Strong Password Policies: Internal accounts are subject to password complexity requirements, including minimum length, character diversity, and regular rotation.
  3. Single Sign-On (SSO): Where applicable, we use SSO solutions to centralise authentication and reduce the attack surface.
  4. Session Management: User sessions are protected against hijacking through secure session tokens, automatic timeouts, and re-authentication for sensitive operations.

Authorisation

Access to systems, data, and resources is governed by the principle of least privilege:

  1. Role-Based Access Control (RBAC): Access permissions are assigned based on job roles and responsibilities, ensuring that individuals only have access to the resources necessary for their duties.
  2. Segregation of Duties: Critical functions are divided among multiple individuals to reduce the risk of fraud or error.
  3. Access Reviews: We conduct regular reviews of access permissions to ensure they remain appropriate and remove access promptly when it is no longer required.
  4. Privileged Access Management: Administrative and privileged accounts are subject to additional controls, including enhanced logging, time-limited access, and approval workflows.

User file access

With respect to user files processed through our conversion services:

  1. User files are accessible only to the user who uploaded them.
  2. Our automated systems process files without human intervention under normal operating conditions.
  3. Access to user files by our staff is strictly limited and requires explicit authorisation, which is granted only for troubleshooting purposes at the user's request.
  4. All access to user files is logged and auditable.
  5. Files are automatically deleted from our servers after a defined retention period, as described in our Privacy Policy.

Infrastructure security

Cloud infrastructure

Our platform is hosted on enterprise-grade cloud infrastructure provided by leading cloud service providers:

  1. Data Centre Security: Our cloud providers maintain SOC 2 Type II, ISO 27001, and other relevant certifications for their data centres.
  2. Geographic Redundancy: Our infrastructure is distributed across multiple availability zones to ensure resilience and high availability.
  3. Network Segmentation: Our cloud infrastructure is segmented into isolated networks to limit the blast radius of any potential breach.
  4. DDoS Protection: We employ distributed denial-of-service (DDoS) protection measures to maintain service availability during volumetric attacks.

Network security

  1. Firewalls: We deploy web application firewalls (WAFs) and network firewalls to filter malicious traffic and protect against common web-based attacks.
  2. Intrusion Detection and Prevention: We operate intrusion detection systems (IDS) and intrusion prevention systems (IPS) to identify and block suspicious network activity.
  3. Network Monitoring: All network traffic is continuously monitored for anomalies, and alerts are generated for investigation when suspicious activity is detected.
  4. VPN and Secure Access: Remote access to our internal networks is restricted to authorised personnel using encrypted VPN connections.

Server security

  1. Hardened Configurations: All servers are configured according to industry-standard hardening guidelines, with unnecessary services and ports disabled.
  2. Patch Management: Operating systems and server software are kept up to date with security patches, applied in accordance with our vulnerability management procedures.
  3. Configuration Management: Server configurations are managed through infrastructure-as-code practices, ensuring consistency and traceability.
  4. Logging and Monitoring: All servers generate comprehensive logs that are centralised, analysed, and retained for security monitoring and forensic purposes.

Application security

Secure development lifecycle

Security is integrated into every stage of our software development lifecycle (SDLC):

  1. Security Requirements: Security requirements are defined at the outset of each development project and incorporated into the design specifications.
  2. Secure Coding Practices: Our development team follows secure coding guidelines based on OWASP (Open Web Application Security Project) standards.
  3. Code Reviews: All code changes undergo peer review with a focus on identifying potential security vulnerabilities before deployment.
  4. Static Application Security Testing (SAST): Automated tools scan our codebase for common vulnerabilities during the development process.
  5. Dynamic Application Security Testing (DAST): We perform automated testing of our running applications to identify vulnerabilities that may not be apparent in source code alone.

File conversion security

Given that file conversion is our core service, we implement specific security measures for the conversion process:

  1. Input Validation: All uploaded files are rigorously validated for file type, size, and structure before processing.
  2. Sandboxed Processing: File conversions are executed in isolated, sandboxed environments to prevent any malicious content from affecting our systems or other users' data.
  3. Malware Scanning: Uploaded files are scanned for known malware signatures and suspicious patterns before and after conversion.
  4. Output Sanitisation: Converted files are sanitised to remove any potentially harmful embedded content.
  5. Resource Limits: Each conversion process operates within strict resource limits (CPU, memory, disk, time) to prevent resource exhaustion attacks.

API security

  1. Authentication and Rate Limiting: All API endpoints require authentication and are subject to rate limiting to prevent abuse.
  2. Input Validation: API inputs are validated against strict schemas to prevent injection attacks and other malicious payloads.
  3. Output Encoding: API responses are properly encoded to prevent cross-site scripting (XSS) and other output-based attacks.
  4. Versioning: We maintain API versioning to ensure backward compatibility while allowing security improvements.

Vulnerability management

Vulnerability identification

We employ multiple methods to identify vulnerabilities in our systems:

  1. Automated Scanning: Regular automated vulnerability scans are performed against our infrastructure, applications, and dependencies.
  2. Security Reviews: We perform internal security reviews of our infrastructure and applications. Independent third-party penetration testing is planned as part of our security roadmap.
  3. Responsible Disclosure: We welcome responsible vulnerability disclosures from the security research community, as described in our Vulnerability Disclosure Policy.
  4. Threat Intelligence: We monitor threat intelligence feeds and security advisories to stay informed about emerging vulnerabilities that may affect our technology stack.
  5. Dependency Monitoring: We use automated tools to monitor our software dependencies for known vulnerabilities and update them promptly.

Vulnerability remediation

Once a vulnerability is identified, we follow a structured remediation process:

  1. Triage and Classification: Vulnerabilities are assessed for severity using the Common Vulnerability Scoring System (CVSS) and prioritised accordingly.
  2. Remediation Targets: We prioritise remediation according to severity. The following are internal targets that we aim to meet rather than binding commitments:
    • Critical vulnerabilities: we aim to remediate within 24 hours.
    • High-severity vulnerabilities: we aim to remediate within 72 hours.
    • Medium-severity vulnerabilities: we aim to remediate within 30 days.
    • Low-severity vulnerabilities: we aim to remediate within 90 days.
  3. Verification: All remediations are tested and verified before being deployed to production.
  4. Documentation: All vulnerability findings, remediation actions, and verification results are documented for audit and compliance purposes.

Patch management

  1. Security patches for operating systems, applications, and dependencies are applied in accordance with our remediation timelines.
  2. Emergency patches for critical vulnerabilities are expedited through an accelerated deployment process.
  3. All patches are tested in a staging environment before being deployed to production.
  4. Patch status is tracked and reported as part of our ongoing security monitoring.

Incident response

Incident response plan

Novitora maintains a documented Incident Response Plan (IRP) that outlines the procedures for detecting, responding to, and recovering from security incidents:

  1. Preparation: We maintain an incident response team with defined roles and responsibilities, supported by tools, training, and playbooks.
  2. Detection and Analysis: Security events are monitored in real time, and potential incidents are triaged and classified based on severity and impact.
  3. Containment: Once an incident is confirmed, immediate steps are taken to contain the threat and prevent further damage.
  4. Eradication: The root cause of the incident is identified and eliminated from our systems.
  5. Recovery: Affected systems and services are restored to normal operations with appropriate safeguards.
  6. Post-Incident Review: After each significant incident, we conduct a thorough post-mortem to identify lessons learned and improve our defences.

Data breach notification

In the event of a personal data breach, we will comply with all applicable notification requirements:

  1. Regulatory Notification: In accordance with the UK GDPR and the Data Protection Act 2018, we will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of a breach that is likely to result in a risk to the rights and freedoms of individuals.
  2. User Notification: Where a breach is likely to result in a high risk to the rights and freedoms of affected individuals, we will notify those individuals without undue delay.
  3. Notification Content: Breach notifications will include a description of the nature of the breach, the categories and approximate number of data subjects affected, the likely consequences, and the measures taken or proposed to address the breach.
  4. Record Keeping: We maintain a register of all personal data breaches, including those that do not meet the threshold for regulatory notification, in accordance with our legal obligations.

Incident communication

  1. We maintain a status page to communicate service disruptions and security-related incidents to our users.
  2. For significant security incidents, we will provide timely updates through email, our website, and/or our status page.
  3. We are committed to transparency in our incident communications while balancing the need to protect ongoing investigations.

Employee security

Hiring practices

  1. Background Checks: All employees and contractors undergo background checks appropriate to their role before being granted access to our systems and data.
  2. Employment Agreements: All personnel sign confidentiality and non-disclosure agreements as a condition of their engagement.
  3. Security Roles: Security responsibilities are clearly defined in job descriptions and performance expectations.

Security training and awareness

  1. Onboarding Training: All new employees receive comprehensive security awareness training as part of their onboarding process.
  2. Ongoing Training: Security awareness training is conducted regularly (at least annually) and covers current threats, company policies, and best practices.
  3. Phishing Simulations: We conduct regular phishing simulation exercises to test and reinforce employee awareness of social engineering threats.
  4. Specialised Training: Employees in security-sensitive roles (e.g., developers, system administrators) receive role-specific security training.

Employee offboarding

  1. Access to all systems and data is revoked promptly upon termination of employment or engagement.
  2. Company-issued devices are returned and securely wiped.
  3. Offboarding procedures are documented and audited to ensure completeness.

Physical security

Data centre physical security

Our cloud infrastructure providers maintain comprehensive physical security controls, including:

  1. Perimeter Security: Data centres are protected by multi-layered physical security, including fencing, security guards, and surveillance systems.
  2. Access Controls: Entry to data centres requires multi-factor authentication, including biometric verification.
  3. Environmental Controls: Data centres are equipped with fire suppression, climate control, and redundant power systems.
  4. Monitoring: Physical access is logged and monitored, with retention of access records for audit purposes.

Office security

Our office facilities are protected by the following measures:

  1. Access Control: Office access is restricted to authorised personnel through electronic access control systems.
  2. Visitor Management: All visitors are required to sign in, provide identification, and be escorted by an employee.
  3. Clean Desk Policy: Employees are required to secure sensitive materials when leaving their workstations.
  4. Device Security: Company devices are encrypted, password-protected, and subject to remote wipe capabilities.

Business continuity

Disaster recovery

We maintain a comprehensive Disaster Recovery Plan (DRP) to ensure the continuity of our services:

  1. Recovery Objectives: We define Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) for our critical systems and services.
  2. Backup Strategy: Data is backed up regularly using a combination of incremental and full backups, stored in geographically separate locations.
  3. Failover Capabilities: Our infrastructure supports automatic failover to secondary systems in the event of a primary system failure.
  4. Testing: We conduct regular disaster recovery tests, including tabletop exercises and full failover simulations, to validate our recovery procedures.

Service availability

  1. Availability: We strive to maintain high service availability and continuously monitor our uptime.
  2. Redundancy: Critical components of our infrastructure are deployed in redundant configurations to eliminate single points of failure.
  3. Capacity Planning: We continuously monitor system capacity and scale our infrastructure proactively to meet demand.
  4. Incident Management: Our incident management process ensures rapid response to service disruptions and minimises downtime.

Data retention and deletion

  1. User files uploaded for conversion are automatically deleted from our servers within the timeframe specified in our Privacy Policy.
  2. Users may request immediate deletion of their files at any time.
  3. When data is deleted, it is removed from all active systems and backups in accordance with our data retention schedule.
  4. We use secure deletion methods to ensure that deleted data cannot be recovered.

Compliance

Regulatory compliance

Novitora is committed to complying with all applicable data protection and security regulations:

  1. UK GDPR: We process personal data in accordance with the principles of the UK General Data Protection Regulation, including lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, and confidentiality.
  2. Data Protection Act 2018: We comply with the requirements of the UK Data Protection Act 2018, which supplements the UK GDPR.
  3. EU GDPR: Where we process personal data of individuals in the European Economic Area, we comply with the EU General Data Protection Regulation.
  4. ePrivacy Regulations: We comply with applicable electronic communications and privacy regulations regarding the use of cookies and similar technologies.

Industry standards

Our security programme is aligned with recognised industry standards and frameworks:

  1. ISO/IEC 27001: Our information security management system is designed in alignment with ISO/IEC 27001 principles.
  2. OWASP: Our application security practices are guided by the OWASP Top 10 and other OWASP guidelines.
  3. NIST Cybersecurity Framework: Our overall security programme is informed by the NIST Cybersecurity Framework.
  4. CIS Controls: We implement applicable controls from the Centre for Internet Security (CIS) Controls.
  5. SOC 2: We follow SOC 2-aligned security practices. We have not yet completed a SOC 2 examination; formal certification is on our security roadmap.

Reviews and assessments

  1. Internal Reviews: We conduct regular internal reviews of our security controls and procedures.
  2. Independent Assessments: Independent third-party security assessments and formal certification (such as SOC 2) are part of our security roadmap and are not yet in place.
  3. Compliance Monitoring: We continuously monitor our compliance with applicable regulations and standards.

Third-party security

Vendor assessment

We carefully evaluate the security practices of third-party vendors and service providers:

  1. Due Diligence: Before engaging any third-party vendor that will have access to user data, we conduct a thorough security assessment of their practices and controls.
  2. Contractual Protections: Our agreements with third-party vendors include data protection clauses, confidentiality obligations, and security requirements.
  3. Data Processing Agreements: Where vendors process personal data on our behalf, we enter into Data Processing Agreements (DPAs) in compliance with the UK GDPR and EU GDPR.
  4. Ongoing Monitoring: We periodically review the security practices of our vendors to ensure they continue to meet our standards.

Sub-processor management

  1. We maintain a list of sub-processors that process personal data on our behalf.
  2. New sub-processors are subject to the same security assessment process as primary vendors.
  3. Users are informed of changes to our sub-processor list in accordance with our Privacy Policy.

Third-party integrations

  1. Third-party integrations with our platform are subject to security review before being made available.
  2. API access for third-party applications is controlled through authentication tokens with appropriate scoping and rate limiting.
  3. We monitor third-party integration activity for suspicious behaviour and anomalies.

Security updates

Communication of security updates

We are committed to keeping our users informed about significant changes to our security practices:

  1. Policy Updates: Material changes to this Security Policy will be communicated through our website and, where appropriate, by email.
  2. Security Advisories: We will publish security advisories when vulnerabilities or incidents may affect our users.
  3. Status Updates: Our status page provides real-time information about service availability and any ongoing security-related incidents.

Continuous improvement

  1. We regularly review and update this Security Policy to reflect changes in our practices, technology, and the threat landscape.
  2. Feedback from security reviews, incident reviews, and vulnerability assessments drives continuous improvements to our security programme.
  3. We actively participate in the security community and stay informed about emerging threats and best practices.

Data protection officer

In accordance with applicable data protection legislation, questions regarding our data protection practices may be directed to our designated contact:

  • Email: legal@novitora.com
  • Address: Uptraff Ltd, 124 City Road, London, England, EC1V 2NX

Contact

If you have any questions, concerns, or suggestions regarding this Security Policy or our security practices, please contact us:

For reporting security vulnerabilities, please refer to our Vulnerability Disclosure Policy or email security@novitora.com directly.

Note: This Security Policy does not create any contractual obligation and is provided for informational purposes. Our obligations to you are governed by our Terms of Service and applicable law.

This Security Policy is effective as of 23 February 2026 and will be reviewed and updated periodically. We encourage you to review this policy regularly for the latest information about our security practices.