Security
Your invoices carry supplier, payment and personal data. This page describes how Nuntiq protects that data, where it is processed and what we do when something goes wrong. It is the security policy our agreements refer to.
Last updated: 24 October 2026.
All customer data is encrypted at rest. The databases and document storage use encryption keys Nuntiq manages in AWS Key Management Service, with scheduled automatic rotation; server disks and message queues use AWS-managed keys. Data in transit is encrypted with TLS. The public entry point uses a TLS 1.3 policy, database connections require encryption and storage refuses unencrypted requests.
Each customer's transactional data lives in its own database, separate from every other customer.
Your users sign in with SAML single sign-on through your identity provider, with multi-factor authentication enforced there, or with passwords under a password policy you control. New users set their own password through a one-time invitation link; passwords are never sent by email. Access inside the portal is role-based, with user groups and granular rights.
Credentials, keys and connector secrets are stored in AWS Secrets Manager and loaded at runtime, never kept in code. Connector secret values are visible only to users with the right to manage connectors, and every time a value is read it is logged. API keys are shown once and stored only as hashes.
A web application firewall with AWS managed rule sets and rate limiting sits in front of the platform's APIs.
Every administrative action in the AWS account is logged, and the logs are kept for at least a year in storage that cannot be altered or deleted, even by Nuntiq. In the application, sign-ins, invoice actions and configuration changes are recorded with user and time.
Security patches are applied on fixed timelines, counted from the day the fix becomes available.
Severity is as rated by our vulnerability scanner, currently Amazon Inspector. For software the scanner does not cover, we use the CVSS base score. A vendor rating of "Important", as used in Amazon Linux security advisories, is treated as high.
Nuntiq runs on Amazon Web Services in the US East (N. Virginia) region. The platform is built for regional data residency: each customer's data is hosted and processed in the AWS region they choose, with regions brought online as customers need them.
Each customer also decides whether AI processing must stay in their own region or may use global endpoints. Regional processing keeps documents in the customer's region; global endpoints give access to the newest models and open-weight models, which are often offered only there. Forcing regional processing can limit which models are available.
These companies process customer data on our behalf, each under a data processing agreement. The binding list, with locations, is part of our Data Processing Agreement; we tell customers before we add one.
Nuntiq has a documented incident response plan with severity levels and response targets (critical incidents within 15 minutes), tested with tabletop exercises.
If a security incident affects your data, we notify you without undue delay and no later than 72 hours after we become aware of it, as our Data Processing Agreement sets out, and keep you informed as the facts become known.
A SOC 2 Type I audit is planned as part of Nuntiq's launch. Our controls are already mapped to the SOC 2 Trust Services Criteria and documented for the auditor.
Write to security@nuntiq.com. For security reviews and questionnaires, we share more detail under a non-disclosure agreement. How to report a vulnerability, and the rules for using the platform: our Acceptable Use Policy. How we handle personal information: our Privacy Policy.