Security at NonaGuard
Your Odoo credentials and infrastructure data are protected by defense-in-depth architecture. We access the minimum data needed to generate health scores and never touch your business records.
Minimal Data Collection
NonaGuard connects to your Odoo instance via read-only XML-RPC and collects only what is needed to assess health and security posture. We never access your business data.
What we read
- Installed module metadata (names, versions, authors)
- Access control rules and permission groups
- System configuration (email, cron, 2FA status)
- Odoo version and database metadata
What we NEVER access
- Invoices, sales orders, or accounting data
- Contacts, customers, or partner records
- Products, inventory, or pricing data
- Any file attachments or document content
Encryption
All sensitive data is encrypted both at rest and in transit using industry-standard algorithms.
- AES-256 encryption for all Odoo credentials at rest
- Per-credential encryption with unique random salts
- TLS 1.3 enforced for all data in transit
- HTTPS-only access with HSTS preload headers (2-year max-age)
- Encryption keys managed separately from application secrets (dual-key architecture)
- Credentials decrypted only in-memory during scan execution, never written to logs
Multi-Tenant Isolation
Each organization’s data is completely isolated at every layer of the stack.
- Firestore security rules enforce document-level access control per organization
- Every API request validates organization membership before returning data
- No cross-tenant data access is possible, even for internal services
- Scan results, credentials, and configurations are scoped to organization IDs
- Account deletion triggers a full data purge across Firestore, Firebase Auth, and Stripe
Authentication & Access Control
Identity verification and role-based permissions protect every action on the platform.
- Firebase Authentication with mandatory email verification
- Role-based access control: Owner, Admin, and Member roles per organization
- JWT token validation on every API request via Firebase Admin SDK
- Token-based API authentication for programmatic access
- Rate limiting and domain-based signup throttling to prevent brute force and abuse
Infrastructure Security
Defense-in-depth across containers, networking, and runtime to minimize attack surface.
- Docker containers run as non-root users with read-only filesystems
- Network isolation between application, worker, and cache services
- Redis secured with authentication and dangerous commands (FLUSHALL, DEBUG, KEYS) disabled
- Caddy reverse proxy with automatic TLS certificate provisioning via Let's Encrypt
- SSRF protection: all scan targets validated against IANA private IP ranges
- Content Security Policy (CSP) headers on all responses
- Zero-downtime deployments with rolling restarts and health checks
AI Data Handling
You control when and where your data is analyzed. NonaGuard follows a Bring Your Own Key (BYOK) model for AI features.
- BYOK model: you provide your own API key for OpenAI, Google, or Anthropic
- Scan data is sent to YOUR chosen AI provider only when YOU request insights
- Only aggregated module metadata is shared (names, scores, risk counts) — never raw Odoo data
- NonaGuard never stores AI API keys in plaintext — AES-256 encrypted at rest
- API keys are validated before saving to ensure they are functional
- No AI provider has persistent access to your data
Connector Security
The NonaGuard Odoo connector module communicates securely with our API using signed requests and hashed credentials.
- HMAC-SHA256 signed webhook requests prevent tampering and replay attacks
- Token-based authentication with SHA-256 hashed storage — plaintext tokens are never persisted
- No inbound ports required on your Odoo server; the connector pushes data outbound only
- Heartbeat mechanism with automatic retry and configurable intervals
- Idempotent webhook processing prevents duplicate data submission
SOC 2 Compliance
We are actively working toward SOC 2 Type II compliance. Our infrastructure and data handling practices are designed with SOC 2 trust principles in mind — including security, availability, processing integrity, confidentiality, and privacy. All architectural decisions documented on this page reflect our commitment to meeting these standards.
Responsible Disclosure
If you believe you have found a security vulnerability in NonaGuard, we encourage responsible disclosure. Please report it to security@hexalian.com with a detailed description of the issue, steps to reproduce, and any supporting evidence. We will acknowledge receipt within 48 hours and work with you to understand and address the vulnerability promptly.
Have Security Questions?
We're happy to answer any questions about how NonaGuard protects your data and infrastructure.