Security
Your portfolio's most sensitive data, treated that way
Navorda holds land agreements, permit timelines, risk exposure and ownership structures — the information a developer least wants loose. This page states what protects it, plainly, including what is still in progress.
Security posture last reviewed:
Certification status: ISO 27001 and SOC 2 in progress
Navorda does not yet hold a completed ISO 27001 certification or SOC 2 attestation — both are in progress. We would rather state that plainly than let you discover it in a questionnaire. In the meantime, the controls below are in production today, and our engineering team answers security reviews directly.
Identity and access
- SSO with Microsoft Entra ID and Google over standard OIDC — your identity provider, your MFA and conditional-access policies, your offboarding: deactivate a user in your IdP and they are offboarded from Navorda
- Short-lived sessions by design: 15-minute access tokens with rotating refresh tokens and reuse detection — a stolen token dies fast
- Permission-based RBAC enforced on every endpoint — four built-in roles plus custom roles per organization
- The access matrix is enforced by automated tests in CI: an ungated endpoint fails the build
- Strict password policy (12+ characters, complexity rules) for local accounts where SSO is not used
Data protection and residency
- Hosted on AWS in the EU — Frankfurt, Germany (eu-central-1): data residency compatible with GDPR requirements
- Encrypted at rest and in transit: encrypted RDS PostgreSQL database, encrypted S3 document storage, TLS everywhere
- Hard multi-tenant isolation — tenant scoping enforced at the data-access layer on every query, not left to application code to remember
- ECS Fargate for workload isolation, ALB for traffic management, and a multi-AZ Amazon RDS database with automated backups — 14-day retention and point-in-time recovery in production
- Nothing is silently destroyed: deletions are soft by default with a Recycle Bin, and permanent deletion is restricted to system administrators
Secure AI on AWS Bedrock
- Navorda AI runs inside Navorda on AWS Bedrock in-region (EU) — project data is never sent to a third-party AI service over the public internet
- No API keys to leak: Bedrock access uses AWS IAM roles, not stored credentials
- Per AWS Bedrock's standard commitment, prompts and outputs are not used to train foundation models or shared with model providers
- AI assists, rules decide: risk and deviation detection is a deterministic rule engine — the AI layer only turns findings into readable explanations and suggested mitigations
Governed AI access
- The Navorda MCP Connector, powered by Navorda's native MCP server, is read-only as a permanent product invariant — no write tools exist, and read-only is enforced in six independent layers
- OAuth 2.1 per-user authorization; the assistant only sees what that user may see
- Disabled per organization until an admin enables it, with optional user allowlists
- Landowner PII is structurally excluded from every MCP response
- Answers are pinned to the official ruling data snapshot, with explicit baseline comparison
Operations and auditability
- Full audit trail — who created and modified every record — plus user activity tracking with an admin dashboard
- Milestone history is retained, not overwritten: previous commitments stay on the record
- Hardened API surface: security headers, rate limiting, strict CORS, input sanitization against XSS, and PII redaction in application logs
- Continuous monitoring: GuardDuty threat detection, VPC Flow Logs, network anomaly alarms with real-time alerting, and application error monitoring across environments
- Secure delivery pipeline: CI/CD authenticates to AWS via OIDC federation — no long-lived cloud credentials — with separated staging and production environments
- Security scanning gates every deploy: static code analysis, dependency audit, container CVE scanning and secret detection — plus nightly container scans and weekly automated dependency updates
- Documented security posture — data classification, incident response, backup & restore, and security roles — maintained as living documents, ready for vendor review
GDPR and privacy
- EU-based vendor: CabSan Solutions is incorporated and operated from Spain — and your data stays in the EU (AWS Frankfurt)
- Website analytics run with Consent Mode v2 defaults set to denied until a visitor opts in
- Data subject rights honoured per GDPR — see the privacy policy
- Data Processing Agreement and security documentation available on request
More on the MCP Connector's six-layer read-only design on the Navorda MCP Connector page. Privacy practices for this website are described in the privacy policy.
Security questions, answered directly
Not yet. ISO 27001 certification and SOC 2 attestation are both in progress. Until they complete, we state this plainly rather than implying otherwise — the same wording appears on our comparison pages. If your procurement requires a completed attestation today, tell us: we can walk your security team through the current architecture and controls directly.
Navorda is fully cloud-native on AWS, hosted in Frankfurt, Germany (eu-central-1), with hard multi-tenant isolation enforced at the data-access layer on every query. Data is encrypted at rest — RDS PostgreSQL for structured data, S3 for documents — and in transit with TLS. The platform runs on ECS Fargate and ALB, monitored with GuardDuty, VPC Flow Logs and network anomaly alarms with real-time alerting.
Navorda uses SSO with Microsoft Entra ID and Google over standard OIDC — your identity provider, your password policies, your offboarding: deactivate a user in your IdP and they are offboarded from Navorda. Because authentication happens at your identity provider, your MFA and conditional-access policies apply to Navorda sign-ins automatically. Application sessions use 15-minute access tokens with rotating refresh tokens and reuse detection. Where SSO is not used, local accounts require passwords of at least 12 characters with complexity rules. Every endpoint enforces permission-based RBAC — four built-in roles plus custom roles per organization — and the access matrix is enforced by automated tests in CI: an endpoint without an access gate fails the build.
No. Navorda AI runs inside Navorda on AWS Bedrock in-region (EU), accessed with AWS IAM roles rather than stored API keys. Per AWS Bedrock's standard commitment, prompts and outputs are not used to train foundation models and are not shared with model providers. Navorda also keeps AI in an explaining role, not a deciding one: risk and deviation detection is a deterministic rule engine, and the AI layer only turns findings into readable explanations and suggested mitigations — no black-box decisions. For external AI assistants, the Navorda MCP Connector is permanently read-only, with landowner PII structurally excluded from every response.
Read-only is a permanent product invariant enforced in six independent layers — no write tools exist in the server, and a server-side lock rejects any mutation regardless of what a client requests. Access is authorized per user with OAuth 2.1, the feature is disabled per organization until an admin enables it, optional allowlists restrict which users may connect, and landowner PII is structurally excluded from every response.
CabSan Solutions is an EU company, and Navorda is hosted in AWS Frankfurt, Germany (eu-central-1), so data stays in the EU. The marketing site runs Google Consent Mode v2 with all consent defaults set to denied until a visitor opts in. Data subject rights are described in our privacy policy, and a Data Processing Agreement is available on request.
Yes. Deletions are soft by default: records go to a Recycle Bin and can be restored, and permanent deletion is restricted to system administrators. Every record carries a full audit trail of who created and modified it, and user activity is visible from an admin dashboard.
Production databases run multi-AZ with automated backups retained for 14 days and point-in-time recovery at 5-minute granularity; the document store is versioned. Recovery objectives are documented — a 4-hour recovery-time target and a 1-hour recovery-point target — and a full restore drill in May 2026 measured roughly 9 minutes of end-to-end recovery and about 3 minutes of maximum data loss, well inside both targets. The procedures live in the backup & restore document, available for vendor review.
Security scanning is built into the delivery pipeline as blocking gates: static code analysis, dependency auditing, container CVE scanning and secret detection all run before any deploy, with nightly container scans and weekly automated dependency updates on top. A documented vulnerability disclosure policy commits to acknowledgement within 3 business days and a remediation or mitigation plan within 14 days for confirmed issues.
Your data is yours, and it is exportable at any time — structured Excel and JSON exports cover the full workspace, in the same formats you use day to day, so there is no lock-in by friction. On termination, tenant data is deleted on request; export assistance and deletion timelines are agreed contractually in the DPA.
AWS is the primary subprocessor — hosting, storage and AI inference (Bedrock) all run in Frankfurt. Supporting services include GitHub (source control and delivery pipeline), Sentry with EU data ingestion (error monitoring) and Microsoft 365 (corporate IT). The current subprocessor list is available on request.
Yes. Email info@cabsansolutions.com and we will provide current security documentation — data classification, incident response, backup & restore, and security roles, maintained as living documents — plus a DPA and direct access to the team that operates the platform, not a sales layer. Security questionnaires are answered by the people who run the infrastructure.
Put your security team in front of ours
Security documentation — data classification, incident response, backup & restore, security roles — a DPA, and answers from the engineers who operate the platform, not a sales layer.
info@cabsansolutions.com