Security
Safe, because we keep less
The safest data is data we never collect. What Nvivio does keep stays in the EU, travels encrypted and is only reachable by the people who need it. This page says how, and what we do not have yet.
- 0IP addresses stored
- 0passwords to steal: you log in with a link by email
- EUyour data stays in Frankfurt
In short
- IP addresses and full user agents are never stored, and by default nothing is stored on your visitor’s device.
- The database and the logins run in Frankfurt; the queue of events and the settings are stored at Cloudflare under EU jurisdiction.
- Everything runs over HTTPS: plain HTTP is redirected, and nvivio.com tells browsers to use nothing else.
- No passwords: you log in with a one-time link by email.
- API keys are shown once and stored only as a hash; AI assistants connect with OAuth.
- The database’s public interfaces reach no data, and every table has row-level security.
- Our administration is behind Cloudflare Access and writes every change, with its reason, to an audit log.
- Delete a site or your organisation, and its data is deleted within 24 hours.
- Found a vulnerability? Email security@nvivio.com; we answer within five working days.
Your data
Collecting less
The IP address is only used in memory, at the moment a visit arrives, and never reaches the queue or the database. In privacy mode, a visitor is recognised by a code that changes every day; the daily key behind it is deleted after 26 hours. Of the user agent, only the browser, the system and the type of device are kept, and addresses are cleaned before anything is stored.
In the EU, without logs
The database and the logins run at Supabase in Frankfurt (AWS eu-central-1). The queue of events, the settings of sites and the connections of AI assistants are stored at Cloudflare under EU jurisdiction. The dashboard, the API and the MCP server run next to the database in Frankfurt. Query results are not cached, and our code keeps no logs of requests. A visit first arrives at the Cloudflare data centre closest to the visitor; for visitors in the EU, that is in the EU.
Encrypted on the way
The script, the collection of events, the website, the dashboard, the API and the MCP server are served over HTTPS; a request over plain HTTP is redirected to HTTPS. Every response of nvivio.com tells browsers to use only HTTPS for a year, on its subdomains too (HSTS). The connection from our code to the database is encrypted, and our providers encrypt stored data and its backups at rest.
Your data, your decision
Data is kept as long as your plan says, and older data is deleted every night. Export visits and daily totals as CSV, from Starter. Delete a site or your whole organisation, and its data is deleted within 24 hours, with an email to confirm it.
Who gets in
Logging in without a password
You log in with a one-time link that we send to your email address, so there is no password to guess, reuse or leak. Nvivio writes and sends that email itself, and only when the login service asks for it with a valid signature.
Access for your team
Everyone in your organisation has a role: owner, admin, editor or reader, for all sites or for one site only. An invitation only works for the exact email address it was sent to, and expires after 30 days.
API keys and AI assistants
An API key is shown once and stored only as a hash. It can be read-only, and you can revoke it at any time. Without a valid key, the API refuses every request, except for the public demo with made-up data. AI assistants connect to the MCP server with OAuth, and their tokens are stored only as hashes. The MCP server has no access to the database: it calls the API as you.
A closed database
Your data is only reached through Nvivio’s own code, which checks on every request who you are and what you may see. The database’s public interfaces (REST and GraphQL) reach no table: the public roles have no rights, GraphQL is switched off, and every table has row-level security.
Our own access
Our administration (admin.nvivio.com) is behind Cloudflare Access, and our own code checks the Access token and a short list of named people again on every request. It shows none of your statistics, only the number of visits per site, and cannot open your dashboard. Every change made there needs a reason and goes into an audit log that cannot be changed or deleted.
How we run Nvivio
Protection in the browser
Every response of nvivio.com carries security headers. No page can be shown inside another site, so nobody can trick you into a click in your dashboard. Files are never read as another type, an address with a path never travels to another site, and camera, microphone, location and ad topics are switched off. Icons of other websites are fetched by Nvivio and served with a strict policy, so an icon can never run code.
Nothing lost, nothing twice
Every event gets a unique identifier as it arrives, so a retried delivery never counts twice. Events wait in a queue with automatic retries and a dead-letter queue, so a short outage of the database loses nothing. The script loads asynchronously, so your page never waits for Nvivio. Our database provider also makes a backup of the database every day; what you delete stays in those backups until they expire.
How we build
Every change runs the type checks and the automated tests, and production is only deployed from the main branch. Secrets stay out of the code and are only given to the service that needs them.
Payments
Payments go through Mollie, in Amsterdam. You enter your card or bank details on Mollie’s own page, so they never reach Nvivio.
Our providers and their audits
Nvivio itself holds no security certification, such as ISO 27001 or SOC 2. We build on providers that are audited independently and publish their certifications: Cloudflare for the network and our code, and Supabase, on Amazon Web Services, for the database. The physical security of the data centres is theirs. Each one is bound by a data processing agreement with obligations at least as strict as ours.
When something goes wrong
If a personal data breach affects your data, we tell you within 48 hours of becoming aware of it, as our data processing agreement promises, and we keep a record of every incident.
What we do not have yet
Better you hear it from us:
- A second login step in Nvivio. Whoever can read your mailbox can log in, so protect your mailbox with two-step verification.
- Login through your company’s own identity provider (single sign-on).
- A certification of our own, such as ISO 27001 or SOC 2.
- A bug bounty: we thank you by name, not with money.
- A public status page.
Found a vulnerability?
Email security@nvivio.com, in English or Dutch. We confirm your report within five working days, keep you informed while we fix it, and take no legal action against research that follows our policy.
The details, in writing
Our security measures are annex 2 of the data processing agreement; with the documents below, they are what we commit to.
See your own site in Nvivio today
Enter your email address, click the link, add your site and paste one line. That is all.
30 days of Pro free · no credit card · log in with a link by email