Security, the foundation of our architecture

Our customers' data is our most valuable asset. We built security into the foundation of every product, not as a feature added later.

332row-level security policies

140+live Supabase and cPanel endpoints

0card numbers stored

1,800+automated tests (NoktApp Hotel)

Cloud and API

Transfer CRM · Alisa · Chatbot

Row-level security: every record locked to its own company
Role-based permission guards and drift checks
Access keys stored as hashes, not plain text
Signed verification codes and timing-attack protection
Signed webhook verification and bot protection
Platform and company admin areas fully separated

Desktop products

POS · Noktappera · Hotel

Operational data stays at the business; only licence and backups on the server
Marketplace keys never reach our server
Every action logged by user; voids and deletions need a manager
Closed financial periods are locked; corrections only by authorized users with a reason
Every screen's permissions verified by automated tests
15-minute local and nightly cloud backups

Accounts and payments

Building · web panels

Email and strong password: at least 12 characters, no default passwords
5 failed attempts lock the account for 15 minutes
Password reset links valid for 1 hour
Card data never processed: dues paid by IBAN with a receipt
Data protection prompts inside the screens

Alisa

Rules first, then AI

Alisa's 206 tools operate within the security rules.

AlisaCustomer service · English

On a call

I would like to change the delivery address for my order.

Caller verified

Order checked for eligibility

Your order has not shipped yet, so I can change the address. What is the new address?

Sure, 12 Central Street.

Address updated, call note saved

Your address has been updated. I am sending you an SMS confirmation.

Request completedLogged

Callers are verified before any account action
Phone number changes only after an SMS code
Cancellation and return eligibility confirmed by a separate check
Tools reach data through our server functions, never the database directly
Call notes are saved and can be reviewed later

Continuous testing without touching live data

Booking isolation, permission privileges, pricing integrity and scheduled job safety are verified with rollback-only tests that never change production data.

Data we don't keep can't leak

We deliberately do not store the riskiest data, such as card numbers and marketplace keys. This makes data protection compliance easier and gives you peace of mind.