Trust Center
How Nopea handles security and data
Nopea runs the same rigor internally that Scanea, Consentea and Maskea provide to customers. This page describes what's actually true today — not a compliance certification. Nopea does not hold third-party certifications such as SOC 2; Scanea helps organisations prepare for SOC 2 readiness, which is a different thing.
Infrastructure
- •Every account is scoped by tenant at the application layer — no customer's data is queryable by another, enforced in code before it ever reaches the database.
- •Scanning and monitoring workloads run as isolated internal services, reachable only from the application server, never exposed directly to the internet.
Encryption
- •Stored credentials (integration tokens, scan-authentication details) are encrypted with AES-256-GCM before they touch the database — the same mechanism is used everywhere credentials are stored, not a different scheme per feature.
- •All traffic to Nopea is served over TLS.
Access control
- •Active scanning against a customer's asset requires explicit, logged authorisation — a consent action recorded with a timestamp and IP address — before it runs.
- •Internal admin actions are gated behind their own authentication, separate from customer sessions.
Data handling
- •Sensitive values (secrets, tokens found during scanning) are masked before being surfaced anywhere in the product — only enough of the value is shown to identify it, never the full value.
- •Findings are described in plain business language, not by the internal tooling used to detect them.
Monitoring & verification
- •Scanea monitors nopea.tech' own security posture continuously — the same posture checks run against Nopea's own site as against customer assets.
- •A finding is never silently marked fixed — it requires repeated clean observations to auto-resolve, and a dedicated rescan to reach a verified state.
Incident response
- •Incidents are correlated and deduplicated automatically, so a real problem surfaces as one actionable alert instead of a flood of noise that gets ignored.
- •Security or availability concerns can be reported to the contact below at any time.
Security contact
Report a security concern or ask about subprocessors:
vc@nopea.tech