Security at Novala
Your business data is sensitive. Payroll records, financial statements, employee information, tax filings, these are among the most important records your business keeps. We treat them that way. This page explains how Novala protects your information at every layer.
Data encryption
All data transmitted between your device and Novala is protected with 256-bit SSL/TLS encryption. This is the same standard used by online banking and is considered military-grade.
All data stored in Novala is encrypted at rest using AES-256, the industry-standard encryption algorithm. Database files, backups, log files, and file attachments are all encrypted. Even if someone gained physical access to our servers, they would not be able to read your data without the encryption keys.
Encryption keys are managed through a hardware security module (HSM) and rotated regularly. Access to keys is limited to a small number of authorized systems and logged.
data residency
Your data is stored in secure global data centers, specifically in the AWS Canada (Central) region located in Montreal. Your data does not leave Canada. This ensures compliance with data residency requirements and protects your data from foreign government access requests.
We do not transfer personal data outside Canada except when strictly necessary for specific integrated services (for example, credit card processing may involve international networks), and only after careful legal review.
Backups are also stored in secure global data centers, in a geographically separate region to protect against localized outages or disasters.
Access controls
Two-factor authentication (2FA) is available for all user accounts and required for accounts with elevated privileges (administrators, accountants with client access). We support both SMS and authenticator app (TOTP) methods.
Role-based access control (RBAC) ensures your team members only see what they need to. You can create custom roles or use our built-in roles (Owner, Admin, Accountant, Payroll Manager, Employee).
All authentication events are logged, and you can review your account's login history at any time. Unusual login attempts (from new devices, new locations, or unusual times) trigger email notifications.
Compliance and certifications
Novala follows SOC 2 Type II compliance standards. This includes controls over security, availability, processing integrity, confidentiality, and privacy. Our compliance is validated through annual audits by independent third parties.
We undergo regular penetration testing to identify and address vulnerabilities before they can be exploited. Findings are prioritized and remediated according to their severity, with critical issues addressed within days.
Our payroll processing complies with all applicable tax and employment laws, and we work directly with the tax authorities to ensure our filings meet current requirements.
Employee training and access
All Novala employees complete security training on their first day and annually thereafter. Training covers password hygiene, phishing recognition, safe handling of customer data, and incident response procedures.
Access to production systems is limited to a small number of engineers with a demonstrated need. All production access is logged, and privileged actions require additional authorization.
Customer support representatives can view your account when necessary to help you, but only after you have opened a support ticket. This access is logged and reviewed.
Incident response
We have an incident response plan in place for security events. In the unlikely event of a data breach affecting your business, we will notify you within 72 hours of confirmation, in accordance with PIPEDA requirements.
Our team is trained to respond quickly to security incidents, contain the impact, notify affected parties, and prevent recurrence. Detailed incident reports are available on request for enterprise customers.
Report a security vulnerability
If you have discovered a security vulnerability in Novala, please contact us at security@getnovala.com. We take these reports seriously and respond within one business day.
We practice responsible disclosure and appreciate researchers who work with us to keep our customers safe. We do not currently offer a paid bug bounty program, but we recognize significant contributions with public acknowledgment (with your permission) and Novala swag.