Security & Trust Center, exact about every claim

We don't hide behind vague
security language.

Here is exactly where we are and where we are heading. Certified, implemented, in progress and planned are four different things, and this page keeps them apart.

Read the register →Request the security pack
5 implemented 2 in progress 2 planned 0 certified
01 · Three pillars

Data, identity,
and the record of both.

Everything on the register below sits inside one of these three pillars.

◒

Data protection

How client data is classified, stored, retained and deleted, and what leaves your environment.

✓ Data classification applied per engagement
✓ Encryption in transit and at rest
✓ Retention and deletion stated in the contract
✓ Client data stays in the client's environment where the architecture allows
◉

Identity & access

Who at Novetum can reach what, on what basis, and how that is reviewed.

✓ Role-based access, granted per engagement
✓ Multi-factor authentication on all internal systems
✓ Access removed on rotation off the engagement
✓ Quarterly access review with a written record
◫

Auditability & governance

The record that lets your auditors check our claims rather than take them.

✓ Change history retained and exportable
✓ Named security owner per engagement
✓ AI governance rules applied to model and data use
✓ Incident process with a defined notification path
02 · Control register

Every control,
with its actual state.

A control in progress is listed as in progress. Nothing on this register is described as a capability before it is one.

ControlStatusDetail
Encryption in transit and at restImplementedApplied across client-facing systems and delivery infrastructure.
Role-based access controlImplementedEnforced internally and applied per engagement.
Multi-factor authenticationImplementedRequired on all internal systems.
Documented incident response processImplementedWritten process with a defined client notification path.
AI governance policyImplementedCovers model selection, data use and human review for AI-assisted delivery.
SOC 2 Type II readinessIn progressReadiness work is under way. We are not certified and do not describe ourselves as such.
ISO 27001 alignmentIn progressAlignment work is under way. Alignment is not certification.
Independent penetration testing cyclePlannedScheduled as a recurring cycle rather than a one-off exercise.
Published sub-processor registerPlannedTo be published once the list is verified and kept current.

Certification claims are the easiest thing on a website to overstate and the easiest for a procurement team to check. Nothing appears in the certified state on this register until a certificate exists and can be produced on request.

03 · For procurement & security review

Ask us for
the evidence.

Security questionnaires, architecture documentation and the current status of any item on this register are available on request. A named security owner is assigned to each engagement.

Security questions? contact@novetum.com

What we will send

✓ Completed security questionnaire
✓ Data handling and retention summary
✓ Access control and review process
✓ AI governance policy
✓ Current status of every in-progress item
Request the pack →
Security & Trust · no vague language

Check every claim,
anytime.

The register above is the live position. If anything on it changes, the page changes with it.

Request the security pack →