Security

Encryption

Credentials for the providers you connect (Interactive Brokers, Plaid and your own AI provider keys) are encrypted at rest with AES-256-GCM.

Personal access tokens, MCP tokens and OAuth tokens are stored only as SHA-256 hashes, so a database copy does not reveal usable tokens. A new token is shown to you once and never again.

Some profile fields (bio, partner name and date of birth) and AI assistant conversations are encrypted at field level. Other data in the database is protected by access controls rather than field-level encryption.

Connections to norviq.org use HTTPS.

Access

A single operator, Fernando Correia, runs Norviq. Administrative access is restricted to a private network (Tailscale) and to SSH from a single administrator IP address; the cluster's management API is not exposed to the public internet. The server was provisioned with the administrator's SSH key.

Connections to brokers and banks are read-only. Norviq cannot place trades, move money or change anything at your financial institution.

You can add a passkey to your account from your profile settings.

Hosting and backups

Norviq runs on a single server at Hetzner Online GmbH in Falkenstein, Germany. A single server means an outage there affects the whole service.

The database is backed up nightly. Backups are encrypted with age before they leave the server and are stored on a Hetzner Storage Box: daily backups for 30 days and monthly backups for 12 months.

Account deletion

You can delete your account in the app (Settings, Profile, Delete account). This removes your data from the live database at once; encrypted backups expire on the schedule above, at the latest 12 months later.

If something goes wrong

If a personal data breach occurs, we contain it, assess the risk, notify the Portuguese data protection authority (CNPD) within 72 hours where the GDPR requires it, and tell affected users without undue delay when the breach is likely to put them at high risk.

Independent review

Norviq has not yet had an independent external security audit or penetration test. The reviews done so far were internal, so they are not independent. This page will say so when that changes.

Report a vulnerability

Email fernando@facorreia.com with a description of the issue, the steps to reproduce it and the impact you expect. Please do not access other people's data, degrade the service or publish the issue before it is fixed.

We will not take legal action against good-faith research that follows these rules. There is no paid bug bounty.

Machine-readable contact details are published in /.well-known/security.txt.

• security.txt
• Privacy Policy