Security

Last updated 14 October 2026.

This English text is a translation; in case of differences the Dutch text prevails.

Where your data lives

• All application data is hosted on our own servers in the Netherlands. It is not stored outside the EU.
• Data is encrypted in transit with TLS. Traffic reaches our servers through Cloudflare.
• Plain HTTP is redirected to HTTPS, and HSTS tells browsers to use HTTPS only.
• Every page is served with a Content-Security-Policy that limits where scripts, styles and other content may be loaded from.

Access control in the product

• Approval is the core of the product: data changes go through draft → pending → approved. With the four-eyes principle on for a table, the author of a change can never approve it themselves; with it off, an approver's own entries are approved straight away and recorded as such.
• Per-table roles separate who may enter data, who may approve it and who may only view it; designing a table's structure is a separate right again.
• Every row records who created it and who approved it, and when — the audit trail is the product, not an add-on.
• Companies are isolated from each other: users only ever see their own company's data.
• Demo environments are sandboxed per visitor and deleted automatically after 48 hours.

Application security

• Built on Django with its standard protections: CSRF tokens on every form, parameterised queries via the ORM (against SQL injection), and template auto-escaping (against XSS).
• Passwords are stored hashed and salted (PBKDF2); we cannot read them.
• Session cookies are HTTPS-only and protected against cross-site request forgery.
• The REST API is disabled for customers by default; where enabled for a pilot, it uses per-user token authentication with the same per-table permissions.
• The contact form and the signup form are rate-limited and spam-protected.

Operations

• Production runs with debug mode off; secrets live in the environment, not in code.
• Internal administration tools are restricted to staff accounts.

Consulting in your environment

When we do consulting work for you, we work inside your own environment through a named guest account that you create and control, and you can block or remove it at any time. We copy no data out of your environment unless you ask us to in writing, and the guest account is handed back and removed when the engagement ends. The formal commitments are in the data processing agreement for consulting.

What we don't offer yet

Honesty over gloss: Normly is a pilot-stage product run by a small team. Today there is no single sign-on (SSO/SAML), no two-factor authentication, no SOC 2 or ISO 27001 certification, and no public status page. These are on the roadmap and pilot feedback decides their order. If one of them is a hard requirement for you, tell us — that signal is exactly what the pilot is for.

Reporting a vulnerability

If you believe you have found a security issue, please email [email protected] with enough detail to reproduce it. We respond within 3 business days, keep you informed, and will not take legal action against good-faith research that respects our users' data.

Questions about security, or need this information for a supplier assessment? Use the contact page — the data processing agreement covers the formal commitments.