Back to home
NorthNorth OS

Security Policy

Last Updated: 4 July 2026

Security is fundamental to North OS. This policy summarises the technical and organisational measures we use to protect the platform and customer data.

1. Encryption

  • All data in transit is encrypted using TLS 1.2 or higher.
  • Data at rest is encrypted using industry-standard algorithms (AES-256 or equivalent) at the infrastructure level.
  • Secrets, API keys and credentials are stored in dedicated secret management systems, never in source code.

2. Authentication and Access

  • Passwords are hashed using modern adaptive hashing algorithms (bcrypt/argon2 class); plaintext passwords are never stored.
  • Multi-factor authentication (MFA) is supported and recommended for all accounts.
  • Internal access follows least-privilege and role-based access control; administrative access is restricted, logged and reviewed.
  • OAuth integrations request only the minimum scopes necessary, and tokens are stored encrypted.

3. Logging and Monitoring

  • Security-relevant events (authentication, administrative actions, data access) are logged.
  • Logs are retained for security purposes for up to 24 months and monitored for anomalies.

4. Testing and Vulnerability Management

  • Code changes go through review before deployment.
  • We perform regular vulnerability scanning and dependency monitoring.
  • Periodic penetration testing is conducted on the platform; material findings are triaged and remediated on defined timelines based on severity.
  • Ethical hackers can report issues under our Vulnerability Disclosure Policy.

5. Incident Response

  • We maintain a documented incident response process covering identification, containment, eradication, recovery and post-incident review.
  • Suspected personal data breaches are assessed immediately; affected customers are notified without undue delay in accordance with our DPA and applicable law (including the UK GDPR 72-hour regulator notification standard where we act as controller).

6. Data Backups and Disaster Recovery

  • Customer data is backed up regularly with encrypted backups.
  • Backups are tested periodically for restorability.
  • We maintain disaster recovery procedures with defined recovery time and recovery point objectives, and infrastructure is hosted across resilient cloud environments.

7. Personnel and Vendor Security

  • Staff with access to customer data are bound by confidentiality and receive security training.
  • Third-party vendors and subprocessors are assessed for security posture before engagement and reviewed periodically.

8. Customer Responsibilities

Security is shared. Customers should: use strong unique passwords and enable MFA; manage team access appropriately; keep integrations scoped to what is needed; and report suspected compromise immediately.

9. Reporting a Security Concern

If you believe you have found a vulnerability, please follow our Vulnerability Disclosure Policy. For suspected account compromise, contact us immediately through the website contact form with "Security" in the subject line.