Security
Security is a release blocker
Tenant isolation
Every record belongs to an organisation and database row-level security prevents access across organisations. Privileged changes happen only in authenticated server-side functions.
Credentials
SMTP passwords are never stored in plaintext in the portal. Only masked identifiers and metadata are kept; secrets will live in a dedicated vault on the relay side.
Administrators
NOVIQ staff access is role-based, audited and requires multi-factor authentication. There is no silent impersonation.
Data minimisation
The customer portal database never stores message bodies, attachments or raw SMTP sessions. The future relay server (Postal) will hold message content temporarily in its delivery queue as a normal part of sending; its retention period will be published before launch.
Certifications
We do not currently hold security certifications and will not claim any until they are achieved.