Security at Novbay

Version 1.0 · Effective October 2026

Your procedures and run records are your team's history. Here's how we protect them, in plain English: what we do today, what we rely on our providers for, and what we don't claim yet.

---

1. Encryption

In transit. Novbay is only served over HTTPS. Everything between your browser and Novbay, and between Novbay and our providers, travels over an encrypted connection.

At rest. Your workspace data lives in a Postgres database run by Supabase, which encrypts stored data on disk. Our website and app run on Cloudflare Workers. We rely on these providers' standard encryption; we don't run our own servers.

2. Your workspace is walled off

Every procedure, run record, change request, and team setting belongs to one workspace. The database checks, on every request, that you are a member of that workspace before it returns or saves anything. This is called row-level security, and it's enforced by the database itself, not just by the screens you see. A person in one workspace can't read or change another workspace's data.

3. Roles and permissions

Each person in a workspace has a role:

• Only the Owner can upgrade, cancel, or change billing, and our server checks this before it opens a checkout or billing page.
• Only the Owner can hand the Owner role to someone else.
• Members see the runner view: they can run published procedures and suggest changes, but they can't edit them.
• When you remove someone from your team, they lose access to the workspace right away.

4. Sign-in

You can sign in two ways. Neither one asks you to create a password for Novbay:

• Continue with Google. Google confirms who you are. We get your name and email address, never your Google password.
• Email link. We email you a one-time sign-in link. It works once and expires after a short time.

Because there's no Novbay password, there's no Novbay password to leak or reuse. Keep your email account secure, since that's what protects your Novbay sign-in. (Two-step sign-in for workspace Owners is on our list. See section 9.)

5. Payments

Paid plans are handled by Stripe. When you upgrade, you enter your card on Stripe's own checkout page. Your card number goes straight to Stripe. Novbay never sees it and never stores it. We keep only what we need to know which plan your workspace is on, such as your Stripe customer ID and subscription status.

6. Run records you can stand behind

• Locked revisions. A procedure has to be published (locked) before it can be run for real. Each run keeps its own copy of the exact revision it used.
• Every sign-off is recorded. Each step records the result (Pass, Fail, or N/A), the name of the person who signed it, and the time. Notes, readings, and photos stay with the step.
• Later edits don't rewrite history. Changing a procedure creates a new revision. Records that were already signed keep showing the version they used. Older revisions are kept for reference.
• Changes have a trail. Suggested changes move through review (suggested, in work, in review) before a Lead, Admin, or Owner publishes a new revision.
• Exportable. Any finished record can be downloaded as a PDF for an advisor, a design review, or a logbook.

A note on what "signed" means here: a Novbay sign-off is a name-and-time stamp tied to the signed-in person's account. It's a clear record of who did each step. It is not a certified electronic signature for regulated industries (see section 8).

7. How we run things behind the scenes

• Few hands on the data. Novbay is small. Only the Novbay team (one person today) can get into the production systems, and only to run, support, or fix the service.
• Secrets stay on the server. Keys that can make changes to the database or to billing are kept in our hosting provider's encrypted settings. They're never sent to your browser and never stored in our code.
• Billing updates are verified. Messages from Stripe are checked for Stripe's signature before we act on them.
• Trusted providers. We build on Cloudflare Workers, Supabase, Stripe, Resend, and Google sign-in instead of running our own servers. The full list, and what each one does, is in our Privacy Policy.

8. What we don't claim (yet)

We'd rather tell you straight:

• Novbay is not HIPAA compliant. Don't store health information in it.
• Novbay does not have a SOC 2 report, ISO 27001, or any other security certification.
• Novbay is not validated for regulated electronic records (for example FDA 21 CFR Part 11 or AS9100 record controls). If your work has to meet those rules, use Novbay alongside your own approved process.
• We haven't had an outside security audit or penetration test yet.
• We don't offer a guaranteed uptime (SLA) right now.
• Novbay isn't meant for export-controlled technical data (such as ITAR) or classified information.

If your team needs any of these, email us. Knowing what you need helps us decide what to build next.

9. What's next

• Optional two-step sign-in (an authenticator app code) for workspace Owners.
• Owner tools to export all of your team's data and to delete a workspace from Settings.
• Daily database backups, kept for 7 days, once we move to our provider's paid database plan.
• An outside security review once Novbay is big enough to justify one.

We'll update this page as each one ships.

10. Report a security issue

If you think you've found a security problem in Novbay, please tell us right away.

• Email: support@novbay.com with "Security" in the subject line.
• Please include: what you found, the steps to reproduce it, and any screenshots or links.
• What to expect: we'll confirm we got your report within 3 business days, keep you posted while we fix it, and let you know when it's resolved. We're happy to credit you if you'd like.

Please test only against your own account and workspace, don't access or change other people's data, and give us a reasonable chance to fix the issue before you share it publicly. We won't take action against anyone who reports a problem in good faith and follows these guidelines.

If something looks wrong with your own account, such as a sign-in you don't recognize, email us the same way and we'll help you lock things down.

---

Questions about security? Email support@novbay.com. See also: Privacy Policy · Data Retention · Your Data Rights · Terms