Security at Novvatar
How we protect your account and your visitors' data. Written from what the code
actually does, including what we don't do yet. If something here is not true of the product,
the product is the bug: tell us.
Last updated 9 November 2026.
In short
Encrypted in transitEvery page, script and answer travels over HTTPS.
Personal data stripped firstEmails, phone numbers, card and bank numbers, addresses and tokens are removed before anything is written to disk.
Nothing typed is recordedVisit replays show clicks and scrolling, never what anyone types into a form.
You choose how longKeep visit data for 7, 30 or 365 days. Recordings are off unless you turn them on.
No cookies, no adsWe don't set cookies, don't follow visitors across sites, and don't sell data.
We never see a cardPayments go through Lemon Squeezy, the merchant of record.
Your account
- Passwords are stored with scrypt and a separate salt for every account, and checked in constant time. We can't read your password.
- Your dashboard session is a signed token that expires.
- A password-reset link is signed too, and stops working as soon as the password changes.
- Sign-in and the heavy parts of the API have rate limits, so nobody can try thousands of passwords or run up your usage.
The line on your website
- Like any embed (analytics, chat, maps), your key is visible in your page's source. That is normal. What protects it is that it only works from the domains you registered.
- The widget is one script. It reads the page to answer questions and to point at buttons; it doesn't change your site's data or send forms on its own.
- Your visitors' typed text is only kept if you turn that on, and even then personal data is removed by pattern first.
Where data lives
- On a persistent volume at Railway, our hosting provider, with their encryption at rest.
- Traffic passes through Cloudflare.
- Business files are backed up automatically every 6 hours, keeping 30 rotating copies.
- Visitor IP addresses are never written to disk. They are only used to work out a rough city.
- Every company that touches the data, and exactly what reaches each one, is listed on our sub-processors list. A test reads every outbound call the product makes and fails if one is missing from that list.
The AI
- Answers and tours are written by OpenAI's models. What we send is the page text after personal data is removed, and never the visitor's id.
- The exceptions (the page address, a region a visitor points at, a name they typed) are named one by one on the privacy page, instead of being hidden behind "anonymised".
When our server reads a website
To learn your site, our server downloads its pages. That kind of feature can be abused to make a server read places it shouldn't (its own internal network, cloud metadata). Every download goes through one single door that only allows public addresses and checks again on every redirect.
Payments
- Lemon Squeezy takes the payment and holds the card details. We never see or store them.
- Their messages to us about your subscription are signed, and we reject any that aren't.
What we don't have yet
We're a small company, and we'd rather you hear this from us than find it in a questionnaire:
- No SOC 2 or ISO 27001 certification yet.
- No external penetration test yet.
- No single sign-on (SSO) for the dashboard yet.
- Backups live with the hosting provider. An off-site copy is built but not switched on.
- The rough-city lookup (ip-api.com) goes over plain HTTP.
- Deleting one single visitor's data is done by hand: you write to us and we do it. Bulk deletion is a button in your dashboard.
If one of these is a blocker for you, tell us. It helps us decide what comes next.
Questionnaires, a DPA, or a problem you found
Write to [email protected]. We answer security
questionnaires, and our data processing terms (the DPA) are on the legal page.
If you found a vulnerability, thank you: tell us before making it public and we'll fix it and tell you when it's done.
If there's ever a breach that affects your data, we tell you without undue delay.