Security

Your designs, photos, logos, team and client links live in a database where row-level security is switched on for every table. A shop can only ever read its own rows, and anything that changes data goes through checks on the server that confirm who you are and what your role allows.

• Owner: everything, including the plan.
• Admin: everything except the plan; manages the team and shop details.
• Installer: designs, previews, templates and client links.
• Viewer: can look but not change anything.

• Passwords are stored hashed by our sign-in provider. We never see them.
• Settings → Security lists every browser signed in to your account, with a button to sign each one out, or all of them at once.
• Changing or resetting your password signs out your other devices. Reset links expire after an hour.
• Sign-in attempts are rate limited.

• Each link has a random address that isn't listed anywhere and tells search engines not to index it.
• You can set a link to expire, and stop sharing it at any time; it stops working immediately.
• A link only shows the design you chose to share and your shop's contact details. Your private notes are never included.

Card payments are handled by Stripe. Card numbers go straight to Stripe, and we never see or store them.

NovaMaster runs over HTTPS, can't be embedded in other sites (which blocks click-jacking), and tells browsers not to guess file types. Uploaded images are checked so their contents match their file type.

If you think you've found a security problem, send the details through the contact form. We'll reply and keep you posted while we fix it.