Security

In short. The safest data is data we never keep: Nvivio never stores IP addresses or full user agents. What we do keep stays in the EU, travels encrypted, sits behind row-level security, and is only reachable by named people for a stated reason.

This page describes the technical and organisational measures of article 32 GDPR. It forms annex 2 of the Data Processing Agreement. We update it when our measures change, without lowering the overall level of protection.

1. Collecting less

• No IP addresses. The IP address is used only in memory, at the moment a visit arrives: to make the visitor code of the day and to check the addresses you excluded. It never reaches the queue or the database.
• A code that changes every day. In privacy mode, a visitor is recognised with a hash of a daily key, the site, the IP address and the browser. The daily key is deleted after 26 hours, so a visit cannot be linked to the next day.
• No full user agent. Only the browser, the operating system and the type of device are kept.
• Clean addresses. Of every URL, only known campaign and search parameters are kept; email addresses in paths become :email, long codes and UUIDs become :id.
• Network names only of large providers in privacy mode, such as Proximus or iCloud Private Relay, never that of a small company network.
• Global Privacy Control is honoured: such browsers are not measured, and what they send anyway is not read.
• Retention per plan: older visits and events are deleted every night.

2. Where the data is

• The database runs at Supabase in Frankfurt (AWS eu-central-1).
• The queue of events, the configuration of sites and the attachments of support emails are stored at Cloudflare under EU jurisdiction.
• The dashboard, the API and our administration run next to the database in Frankfurt.
• Query results are not cached, and we keep no logs of requests.
• A request first arrives at the Cloudflare data centre closest to the visitor; for visitors in the EU, that is in the EU. The Subprocessors page lists every provider.

3. Encryption

• The script, the collection of events, the dashboard, the API, the MCP server and the links in our emails use HTTPS (TLS).
• The connection between our code and the database is encrypted.
• Our providers encrypt the stored data and its backups at rest.

4. Access to data

• For you: each organisation has roles (owner, admin, viewer) and access per site; an invitation only works for the exact email address it was sent to and expires after 30 days.
• Login without passwords: a one-time link by email, or a sign-in provider; so there are no passwords to steal.
• API keys are shown once and stored only as a hash; they can be read-only, and you can revoke them at any time.
• The database is closed: it cannot be reached from the internet through REST or GraphQL; the public roles have no rights; every table has row-level security.
• The public demo only shows made-up data, and is limited per visitor.

5. Our own access

• Our administration (admin.nvivio.com) is behind Cloudflare Access. Our own code checks the Access token again on every request and accepts only a short list of named people.
• Every change made in the administration requires a reason and is written to an audit log.
• The administration does not show the statistics of a customer (sources, pages, visitors), only the number of visits per site. Looking into a customer’s dashboard requires that customer’s permission.
• Changes in the administration only come from its own screens, with protection against requests from other sites, a strict Content Security Policy and no caching.

6. Reliability

• Every event gets a unique identifier at the edge, so a retried delivery never counts twice.
• Events go through a queue with automatic retries and a dead-letter queue, so a short failure of the database loses nothing.
• The script is small and loads asynchronously, so a visitor’s page never waits for Nvivio.
• Our database provider makes daily backups and keeps them for up to 7 days.

7. Development and operations

• Automated tests run on every change, and production is only deployed from the main branch.
• Secrets are kept out of the code and are only available to the services that need them.
• Icons of other websites are fetched by Nvivio itself and served with a strict policy, so an icon can never run code.

8. People and incidents

• Everyone who works on Nvivio is bound to confidentiality and only has the access their work needs.
• We notify customers of a personal data breach that affects their data within 48 hours of becoming aware of it (article 9 of the Data Processing Agreement) and keep a record of every incident.
• Found a vulnerability? See our responsible disclosure policy.

Versions

• 1.0, 25 October 2026: first version.