Trust Center
Security at Novastraxis
Security is not a feature we add to our platform — it is the foundation upon which everything is built. We protect over $4 billion in global data assets across 2,400+ enterprise deployments with a defense-in-depth architecture verified by independent auditors and tested continuously by our internal red team.
Security Philosophy
At Novastraxis, security is embedded into every layer of our organization — from the silicon in our custom hardware to the culture of our engineering teams. Our security philosophy is grounded in three core principles:
Zero Trust
Never trust, always verify. Every request is authenticated, authorized, and encrypted regardless of origin.
Defense in Depth
Multiple overlapping security controls at every layer ensure no single point of failure can compromise the system.
Assume Breach
We architect our systems assuming adversaries are already inside. Blast radius isolation and rapid detection are paramount.
These principles inform every technical decision, hiring practice, and operational procedure at Novastraxis. Our dedicated security organization reports directly to the CISO and operates independently of the engineering teams whose work it audits, ensuring separation of duties and objective assessment.
Infrastructure Security
Our infrastructure is owned and operated by Novastraxis across 48 global regions with 180+ points of presence. We do not rely on public cloud providers for our core platform, eliminating shared tenancy risks and giving us complete control over the security of every layer.
Physical Security
- All data centers are SOC 2 Type II audited, purpose-built facilities with 24/7/365 on-site security personnel, biometric access controls (iris and fingerprint), and mantrap entry systems.
- Perimeter security includes vehicle barriers, CCTV surveillance with 90-day retention, intrusion detection sensors, and security patrols at randomized intervals.
- Server rooms enforce dual-person access policies. All hardware access is logged, time-limited, and requires pre-authorized maintenance tickets.
- Environmental controls include redundant HVAC systems, FM-200 fire suppression, water leak detection, and seismic bracing in applicable regions.
- End-of-life hardware undergoes NIST 800-88 compliant media sanitization, including cryptographic erasure and physical destruction, with full chain-of-custody documentation.
Network Security
- Privately-owned dark fiber backbone connecting all regions with no traversal over public internet between data centers. Inter-region traffic is encrypted using MACsec (IEEE 802.1AE) at the link layer.
- Multi-layered DDoS mitigation using Anycast routing, rate-limiting, traffic scrubbing centers, and automated black-hole routing. Capacity exceeds 15 Tbps of sustained mitigation.
- Micro-segmented network architecture using software-defined networking (SDN). Each customer workload operates in an isolated virtual network with cryptographically enforced boundaries.
- Network intrusion detection and prevention systems (IDS/IPS) deployed at every network boundary and inter-segment junction, with signatures updated hourly from our threat intelligence feeds.
- All DNS resolution uses DNSSEC validation and DNS-over-HTTPS (DoH) to prevent DNS spoofing and eavesdropping attacks.
Application Security
- Secure Software Development Lifecycle (SSDLC) integrated into all engineering workflows. Mandatory security reviews for every code change, automated static analysis (SAST), dynamic analysis (DAST), and software composition analysis (SCA) in CI/CD pipelines.
- All APIs enforce authentication, authorization, input validation, rate limiting, and request signing. API keys are rotated automatically and scoped to minimum required permissions.
- Web Application Firewall (WAF) with custom rulesets protects all public-facing endpoints against OWASP Top 10 vulnerabilities, including SQL injection, cross-site scripting (XSS), and cross-site request forgery (CSRF).
- Container images are built from minimal base images, scanned for vulnerabilities before deployment, signed with Sigstore Cosign, and run with read-only file systems, no-root privileges, and restricted syscall profiles (seccomp/AppArmor).
- Runtime application self-protection (RASP) monitors production applications for exploitation attempts, providing an additional layer of defense beyond perimeter controls.
Data Encryption
All customer data is encrypted both at rest and in transit using industry-leading cryptographic standards. Our encryption implementation is audited annually by independent cryptography experts.
Encryption at Rest
AES-256
- AES-256-GCM for all data at rest across storage, databases, and backups
- Customer-managed encryption keys (CMEK) supported via our Key Management Service
- Hardware Security Modules (HSMs) — FIPS 140-2 Level 3 validated — for key generation and storage
- Automatic key rotation every 365 days with support for on-demand rotation
- Envelope encryption with data encryption keys (DEKs) wrapped by key encryption keys (KEKs)
Encryption in Transit
TLS 1.3
- TLS 1.3 enforced on all external connections; TLS 1.2 with strong cipher suites as minimum
- Perfect Forward Secrecy (PFS) using X25519 key exchange on all connections
- Mutual TLS (mTLS) for all service-to-service communication within the platform
- Certificate transparency logging and automated certificate lifecycle management
- HSTS preloading, OCSP stapling, and CAA DNS records for all public domains
We maintain a public Cryptographic Standards page documenting all supported cipher suites, key lengths, and protocols. Legacy protocols (SSL 3.0, TLS 1.0, TLS 1.1) are permanently disabled across all endpoints with no option to re-enable.
Access Controls
Novastraxis enforces strict access controls based on the principle of least privilege. No employee, system, or process has access to data or systems beyond what is strictly necessary to perform its function.
- Role-Based Access Control (RBAC): Fine-grained, hierarchical RBAC across all platform resources. Over 200 predefined roles with support for custom role definitions. Role assignments are reviewed quarterly by the security team and require managerial approval.
- Multi-Factor Authentication (MFA): MFA is mandatory for all user and administrative accounts. Supported methods include FIDO2/WebAuthn hardware security keys (preferred), TOTP-based authenticator apps, and push notifications. SMS-based MFA is not supported due to SIM swapping risks.
- Single Sign-On (SSO): Enterprise SSO integration via SAML 2.0, OpenID Connect, and SCIM provisioning. Support for all major identity providers including Okta, Azure AD, Google Workspace, and Ping Identity. Just-in-time provisioning and automatic deprovisioning ensure access is always current.
- Privileged Access Management (PAM): All administrative access to production systems uses time-limited, just-in-time credentials issued through our PAM platform. Sessions are recorded, monitored in real-time by the SOC, and subject to random audit review.
- API Security: API authentication via OAuth 2.0 with short-lived access tokens (15-minute TTL). Service accounts use mutual TLS certificates. All API access is logged with immutable audit trails retained for a minimum of three years.
Vulnerability Management
Our vulnerability management program combines automated scanning, manual testing, threat intelligence, and community research to identify and remediate vulnerabilities before they can be exploited.
- Continuous automated vulnerability scanning of all infrastructure, applications, and container images. Critical vulnerabilities (CVSS 9.0+) are triaged within 4 hours and remediated within 24 hours. High-severity vulnerabilities (CVSS 7.0-8.9) are remediated within 7 days.
- Software composition analysis (SCA) monitors all third-party dependencies for known CVEs. Automated pull requests are generated for dependency updates, and vulnerable packages are blocked from deployment.
- Threat intelligence feeds from commercial, open-source, and government sources (including CISA, US-CERT, and sector-specific ISACs) are integrated into our security operations platform for proactive threat hunting.
Bug Bounty Program
Novastraxis maintains an active bug bounty program through HackerOne, inviting security researchers worldwide to identify and responsibly disclose vulnerabilities in our platform. Our program features:
- Bounty rewards ranging from $500 to $50,000 based on severity and impact
- Safe harbor provisions protecting researchers acting in good faith
- Average first response time of less than 6 hours
- 1,200+ valid reports resolved since program inception
Responsible Disclosure
If you discover a security vulnerability in any Novastraxis product or service, we encourage you to report it responsibly. Please send your findings to:
Please encrypt your report using our PGP public key (available on our security page and at keys.openpgp.org). We ask that you do not publicly disclose the vulnerability until we have had a reasonable opportunity to address it, typically within 90 days.
Incident Response
Novastraxis maintains a mature, well-rehearsed incident response program designed to detect, contain, eradicate, and recover from security incidents with minimal impact to customers.
24/7 Security Operations Center
<15 min
Initial response time for all severity levels
14B+
Security events processed daily
24/7/365
Continuous monitoring and staffing
Incident Response Lifecycle
1. Detection & Triage
Automated detection via SIEM, EDR, network telemetry, and behavioral analytics. ML-based anomaly detection identifies novel threats. All alerts are triaged by SOC analysts within 15 minutes, with automated escalation for critical indicators of compromise.
2. Containment
Immediate containment actions include network isolation, credential revocation, and workload quarantine. Blast radius is minimized through our micro-segmented architecture. Forensic snapshots are captured before containment to preserve evidence.
3. Eradication & Recovery
Threat hunting across all environments to identify and remove all attacker artifacts. Systems are rebuilt from verified-clean images. Recovery procedures are executed with continuous monitoring for re-compromise indicators.
4. Post-Incident Review
Blameless post-incident reviews are conducted within 72 hours for all significant incidents. Root cause analysis, timeline reconstruction, and lessons-learned documentation drive continuous improvement. Affected customers receive detailed incident reports.
Customer notification timelines comply with all applicable regulations: GDPR (72 hours), HIPAA (60 days), and individual state breach notification laws. Enterprise Critical tier customers receive dedicated incident liaisons and real-time status updates through their private status page.
Compliance & Certifications
Novastraxis maintains an extensive portfolio of compliance certifications and attestations, independently audited and renewed on a continuous basis. For detailed information about each certification, visit our Compliance Center.
| Certification | Status |
|---|---|
| SOC 2 Type II | Active |
| ISO 27001:2022 | Active |
| ISO 27017 | Active |
| ISO 27018 | Active |
| FedRAMP High | Authorized |
| HIPAA / HITECH | Compliant |
| PCI DSS Level 1 | Certified |
| CSA STAR Level 2 | Certified |
| NIST 800-53 Rev 5 | Aligned |
| StateRAMP | Authorized |
Penetration Testing
Novastraxis conducts rigorous, quarterly penetration testing of our platform through independent, CREST-accredited security firms. Our penetration testing program includes:
- External Testing: Network perimeter, web application, API, and mobile application testing from an external adversary perspective. Tests include OWASP Top 10, business logic vulnerabilities, and authentication/authorization bypass attempts.
- Internal Testing: Assume-breach scenarios where testers operate from within the network to assess lateral movement potential, privilege escalation paths, and data exfiltration risks.
- Red Team Exercises: Full-scope adversary simulations conducted bi-annually, including social engineering, physical security, and combined attack vectors targeting specific high-value objectives.
- Cloud Configuration: Infrastructure-as-code review, container security assessment, Kubernetes cluster hardening validation, and IAM policy analysis.
Executive summaries of penetration test results are available to customers under NDA upon request. Remediation timelines are tracked and reported to our Board of Directors quarterly. Enterprise customers may also conduct their own penetration testing against their dedicated environments with prior coordination.
Employee Security
Our people are our first line of defense. Every Novastraxis employee and contractor undergoes rigorous security vetting and continuous education to maintain the highest security standards.
- Background Checks: Comprehensive background screening for all employees and contractors prior to onboarding, including criminal history, employment verification, education verification, and credit checks for roles with financial system access. Employees with access to FedRAMP environments undergo additional government-standard background investigations.
- Security Training: Mandatory security awareness training during onboarding, with annual refresher courses. Role-specific training for developers (secure coding), operations (incident response), and executives (threat landscape briefings). Training completion is tracked and reported as a board-level metric.
- Phishing Simulations: Monthly phishing simulation campaigns targeting all employees. Click rates are tracked individually and by department. Employees who fail simulations receive immediate remedial training. Our organization-wide click rate is consistently below 2%.
- Acceptable Use & Confidentiality: All employees sign comprehensive confidentiality agreements, acceptable use policies, and intellectual property assignment agreements. Annual policy acknowledgment is required for continued system access.
- Offboarding: Automated deprovisioning of all system access within 1 hour of employment termination. Exit interviews include security debriefing and return of all company assets. Physical access credentials are revoked immediately.
Subprocessor List
In accordance with our obligations under GDPR Article 28 and our Data Processing Agreements, we maintain a transparent list of subprocessors that may process customer personal data. All subprocessors are contractually bound to data protection obligations no less protective than those in our customer agreements. We provide at least 30 days' advance notice before engaging a new subprocessor.
| Subprocessor | Purpose | Location |
|---|---|---|
| Akamai Technologies | Content delivery and DDoS mitigation | Global |
| Stripe, Inc. | Payment processing | United States |
| Twilio SendGrid | Transactional email delivery | United States |
| Datadog, Inc. | Infrastructure monitoring and observability | United States |
| Snowflake Inc. | Analytics data warehousing (aggregated, de-identified data only) | United States |
| PagerDuty, Inc. | Incident management and on-call routing | United States |
| Zendesk, Inc. | Customer support ticketing | United States |
| HackerOne, Inc. | Bug bounty platform and vulnerability coordination | United States |
Last updated: April 11, 2026. To subscribe to subprocessor change notifications, contact privacy@novastraxis.com.
Questions about our security practices?
Our security team is available to discuss your organization's specific requirements, provide audit reports under NDA, and answer any questions about how we protect your data.