Trust Center
How Nautillo Pro protects your data
Security, privacy, and compliance information for teams evaluating Nautillo Pro — in one place, ready for your vendor review.
EU data residency
Customer data is stored and processed in Supabase's Frankfurt region (EU).
Encrypted everywhere
TLS 1.2+ in transit (TLS 1.3 preferred), AES-256 at rest.
Short-lived scan credentials
AES-256-GCM encrypted, deleted after the scan (max 24 hours), never logged or reported.
GDPR DPA available
Article 28 Data Processing Addendum with Standard Contractual Clauses.
Security overview
Encryption in transit
All traffic between browsers, the API, and our infrastructure uses TLS 1.2 or higher, with TLS 1.3 preferred. HSTS is enforced on nautillo.pro.
Encryption at rest
Scan results, account data, and audit logs are encrypted with AES-256 by our database provider.
Scan credential handling
Credentials you supply for authenticated scans are encrypted with AES-256-GCM, kept server-side for the duration of the scan only (maximum 24 hours), then permanently deleted. They are never sent to the browser, never logged, and never included in reports.
Tenant isolation
Every customer's scans, findings, and evidence are isolated with database row-level security. Cross-account access is technically prevented.
Access control
Team roles control who can launch scans and view reports. Production access for Nautillo staff is limited to authorised personnel on a need-to-know basis.
Authorised, scope-safe testing
Every scan requires typed authorisation and consent records tied to your account. Optional DNS domain ownership verification and non-destructive defaults keep simulations controlled.
Data retention
Scan evidence (HTTP captures) is kept 7–60 days and scan results 30 days to 24 months depending on plan. Uploaded files are purged immediately after analysis. You can request deletion at any time.
AI data minimisation
AI-guided features are opt-in (Business plan). Only scan metadata and short, truncated response excerpts are sent, and credentials, cookies, tokens, emails, card numbers, and IBANs are masked automatically before anything leaves our infrastructure. Public JavaScript files are sent unmasked to detect hardcoded secrets. Model training on our API data is disabled.
Incident response
Severity-based escalation with P0 acknowledgement within 15 minutes in business hours. Personal data breaches are reported to the Estonian Data Protection Inspectorate within 72 hours (GDPR Art. 33).
Data residency
Account data, scan results, evidence, and authentication are stored and processed in the EU, in Supabase's Frankfurt (Germany) region. Nautillo Pro is operated by NØRTH HŪMAN OÜ, an Estonian company, and our lead supervisory authority is the Estonian Data Protection Inspectorate.
Website delivery and API proxying run on Cloudflare's global network; API traffic transits Cloudflare but no personal data is stored there. Any transfer outside the EU/EEA is covered by Standard Contractual Clauses (Commission Decision 2021/914) or an adequacy decision.
Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Frontend hosting (Cloudflare Pages), DNS, CDN, cookie-free website analytics (aggregated only), and API request proxying. API traffic transits through Cloudflare but no personal data is stored on Cloudflare infrastructure. | EU / US (SCCs in place) |
| Supabase, Inc. | Managed database, authentication, file storage, and edge functions. Hosted within the EU (Frankfurt region) on Supabase's own managed infrastructure | EU (Frankfurt) |
| Stripe, Inc. | Payment processing and billing | EU / US (SCCs in place) |
| Sendinblue SAS (Brevo) | Transactional email delivery (account verification, password reset, team invitations, support replies). Processes recipient name and email address and message content. | EU (France) |
| OpenAI, Inc. | AI-assisted vulnerability analysis for Business plan features (engaged only when AI-guided tests are enabled by the Controller). Receives scan metadata and truncated excerpts of target HTTP responses with credentials, tokens and common personal-data patterns masked before transfer. | US (SCCs in place) |
We give at least 14 days' notice before adding or replacing a sub-processor, as set out in our DPA.
Compliance and certifications
GDPR
Compliant processing
DPA with SCCs, EU data residency, data subject rights process.
SOC 2 Type II
Not yet certified
Nautillo Pro is working toward formal certification. Our database provider (Supabase) holds SOC 2 Type II.
ISO 27001
Not yet certified
On our certification roadmap.
Nautillo Pro reports can support your own SOC 2, ISO 27001, PCI DSS, and GDPR audits as evidence of ongoing security testing. Nautillo Pro is not a certification authority and does not issue compliance certificates.
Vulnerability disclosure
Found a security issue in Nautillo Pro? Email support@nautillo.pro with the subject "Security Vulnerability Report". We acknowledge reports within 24 hours, validate within 48 hours, and credit researchers on request. Good-faith research within our published scope is protected — we will not pursue legal action.
Machine-readable contact details are published at /.well-known/security.txt.
Policies and documents
- Data Processing Addendum (DPA)
- Privacy Policy
- Terms of Service
- Acceptable Use Policy
- Cookie Policy
- Security Contact & Incident Response
Need a security questionnaire answered or a countersigned DPA? Email support@nautillo.pro with subject "Security Review" — we respond within 5 business days.