Security & Trust

Novatree.ai is built to handle sensitive people data responsibly. This page summarizes our security posture, our infrastructure, the subprocessors we rely on, and our compliance roadmap. It exists to help your security and procurement teams evaluate Novatree quickly.

1. Infrastructure & hosting

Novatree is hosted entirely on Amazon Web Services (AWS), one of the most rigorously certified cloud platforms in the world. AWS maintains SOC 1/2/3, ISO 27001, and other certifications for the physical and network infrastructure it operates. We build on that foundation and are responsible for how we configure and operate our application on top of it (see the shared-responsibility model below).

2. Data protection

• Encryption in transit: all traffic is encrypted using TLS.
• Encryption at rest: stored data is encrypted using industry-standard algorithms.
• Segregation: customer data is logically separated so that one customer cannot access another's data.
• Backups: data is backed up to support recovery, with restoration procedures maintained.

3. Access control

• Access to production systems and customer data is restricted on a least-privilege basis to personnel who need it.
• Administrative access requires strong authentication.
• Access is logged and reviewed; credentials are rotated and de-provisioned promptly when no longer needed.

4. The AWS shared-responsibility model

We are deliberately precise about this, because your security team will expect us to be. AWS secures the cloud infrastructure — data centers, hardware, and core network. Novatree is responsible for security in the cloud — how we configure encryption, identity and access management, logging, network controls, and application security. Being hosted on AWS gives us a strong, certified foundation; it does not by itself make an application secure. Our controls, described on this page and evidenced through our SOC 2 program, are what govern the security of your data within Novatree.

5. Subprocessors

We use a small number of vetted providers to deliver the Services. Each is bound by data-protection terms, and we review their security posture before onboarding and periodically thereafter.

Subprocessor	Purpose	Region
Amazon Web Services (AWS)	Cloud infrastructure & hosting	United States
Amazon DynamoDB	Managed database	United States
Amazon Bedrock	Foundation models for AI features; inputs are not used for model training	United States
Amazon SES	Email delivery: sign-in links, notifications, candidate messages	United States
Stripe	Subscription billing; receives billing contacts only, never candidate or employee data	United States
Google Workspace, Slack	Only when a customer connects them: calendar scheduling, notifications and approvals	Global

The full list, with each provider's service and purpose, is on the Sub-processors page. We maintain a current subprocessor list and notify customers of material changes as required by our agreements.

6. Compliance & certifications roadmap

• SOC 2 Type II — planned. A Type II examination evaluates whether controls operate effectively over a period (typically 3–12 months) and is the standard enterprise buyers expect. We are building toward this; a summary/bridge status will be shared here and under NDA as it progresses.
• GDPR / UK GDPR — we support customer compliance through our Data Processing Addendum, Standard Contractual Clauses where required, and processor commitments.
• CCPA / CPRA — we act as a service provider and do not sell personal information.

7. Privacy

How we handle personal information — including our controller/processor roles and individual rights — is described in our Privacy Policy. In short: customer data in the platform belongs to the customer, we process it only on their instructions, and we do not sell it.

8. Vulnerability & incident response

• We monitor our systems and apply security updates on a regular cadence.
• We maintain an incident-response process and will notify affected customers of a data breach without undue delay, consistent with our agreements and applicable law.
• To report a security concern, contact security@novatree.ai.

9. Security questionnaires & documentation

We welcome security and vendor-risk reviews. We will complete standard questionnaires (for example, SIG or CAIQ) and, under NDA, share additional documentation relevant to your evaluation. Start a review at security@novatree.ai.

This page is provided for general information and to support customer due diligence. It is not legal advice. Novatree.ai should have this document reviewed by qualified privacy counsel before it is relied upon, particularly regarding GDPR/UK GDPR, CCPA/CPRA, and jurisdiction-specific employment-data obligations.