Security

Last updated: 17 August 2026

This page provides a high-level description of our security approach and explains how to report a suspected vulnerability.

It does not disclose confidential controls, guarantee that every measure applies to every system or represent a certification of security.

Our security principles

Our approach is guided by the following principles:

Security by design

Security requirements are considered during architecture, development, deployment, operation and change management rather than being treated solely as a final-stage activity.

Risk-based controls

Controls are selected according to the sensitivity of the information, system criticality, threat exposure, contractual requirements and operating environment.

Least privilege

Access should be limited to the minimum permissions and duration necessary for an authorised purpose. Administrative access is separated and more tightly controlled where appropriate.

Strong authentication

Multifactor authentication is required for supported administrative access paths and other higher-risk functions where technically available and appropriate.

Data protection

Information is protected according to its classification and processing context. This may include encrypted transport, storage protections, access restrictions, retention controls and secure deletion procedures.

Segmentation and isolation

Systems, administrative functions and customer environments are separated according to their purpose and risk profile, where applicable.

Secure development

Software-development practices may include:

• source control
• peer review
• dependency management
• automated testing
• static analysis
• secret detection
• controlled deployment
• remediation tracking.

The specific controls applied depend on the project’s agreed scope and risk profile.

Monitoring and accountability

Relevant security and operational events are logged, monitored and reviewed according to the system, service model and applicable retention requirements.

Monitoring scope and response coverage depend on the contracted or internally approved operating model. This page does not represent a commitment to continuous 24/7 monitoring unless that coverage is expressly agreed.

Vulnerability and patch management

We assess relevant vulnerabilities, dependencies and security updates and prioritise remediation according to exposure, severity, exploitability, system criticality and available mitigations.

Resilience and recovery

Security planning includes preparation for detection, containment, continuity and recovery. Backups, restoration procedures and resilience controls are selected and tested according to the applicable system and service requirements.

Continuous improvement

Incidents, vulnerabilities, changes in threats and operational findings are used to improve technical and organisational controls.

Shared responsibility

Security responsibilities vary according to the service or project.

Customers and counterparties remain responsible for matters assigned to them by the applicable agreement, which may include:

• authorised users
• endpoint security
• credential protection
• application configuration
• workload legality
• data classification
• access approval
• customer-controlled networks
• timely notification of relevant incidents.

The applicable contract, service description and responsibility matrix take precedence over this general page.

Reporting a suspected vulnerability

If you believe you have identified a security vulnerability affecting this website or another NOVACORE AI system that you are authorised to access, please report it privately to:

Email: office@novacoresoftai.com Subject: Security Vulnerability Report

Until a dedicated security mailbox or encrypted reporting channel is published, do not include passwords, private keys, complete personal datasets, classified information or unnecessary sensitive material in the initial email.

We may provide an alternative channel after receiving the initial notification.

Information to include

A useful report should contain, where available:

• the affected URL, hostname, service or component
• the date and time of discovery
• a clear description of the suspected vulnerability
• the steps required to reproduce it
• the observed and expected behaviour
• the potential security impact
• relevant configuration or browser details
• minimal supporting evidence
• whether personal or confidential information may be affected
• your preferred contact details
• any disclosure deadline you are considering.

Please remove or redact information that is not necessary to demonstrate the issue.

Do not send malicious executables or weaponised code without prior agreement.

Research and testing boundaries

This page provides a reporting channel. It does not grant unrestricted authorization to test NOVACORE AI systems.

Unless separate written authorization has been provided, do not:

• access, modify, copy or delete another person’s data
• retain personal, confidential or proprietary information
• perform denial-of-service or resource-exhaustion testing
• conduct phishing, social engineering or physical-security testing
• use malware or persistence mechanisms
• compromise accounts belonging to other users
• pivot into connected systems
• exploit a vulnerability beyond the minimum necessary to confirm it
• disrupt services or normal business operations
• test customer environments or third-party systems
• access systems not publicly exposed for testing
• publish vulnerability details before coordination.

If you encounter sensitive information, stop testing, avoid further access and notify us promptly.

Security testing performed under a separately executed agreement is governed by that agreement.

Our response process

After receiving a report, we will seek to:

1. 01confirm receipt through an appropriate channel
2. 02assess whether the affected asset is within our control
3. 03reproduce and evaluate the reported issue
4. 04prioritise it according to risk and impact
5. 05develop or coordinate appropriate mitigation
6. 06communicate material status updates where practicable
7. 07agree on coordinated disclosure where public disclosure is appropriate.

Response and remediation time depend on severity, complexity, affected third parties, availability of fixes and operational risk.

Submission of a report does not create a contractual relationship or guarantee payment, recognition or a specific remediation date.

Coordinated disclosure

Please allow a reasonable period for investigation and mitigation before publishing technical details.

We ask reporters to coordinate disclosure timing with us so that affected users and systems can be protected. If a third-party product or service is involved, coordination may require the participation of its vendor, hosting provider or an appropriate vulnerability coordinator.

We will not ask for indefinite confidentiality. Any disclosure plan should consider the severity of the issue, exploitation risk, remediation status and potential impact on users.

No bug-bounty programme

NOVACORE AI does not currently operate a public bug-bounty programme.

A vulnerability report does not create an entitlement to payment, reward, employment, procurement preference or commercial engagement unless agreed separately in writing.

Do not incur costs on our behalf without prior written authorization.

Security incidents and urgent matters

This reporting channel is intended for suspected vulnerabilities.

If you believe an active security incident is occurring, identify the message as URGENT SECURITY INCIDENT and provide only the information necessary for initial triage.

Where there is an immediate risk to life, physical safety or public security, contact the appropriate emergency service or competent authority.

Security statements and limitations

We aim to reduce risk, strengthen resilience and improve recovery readiness.

No organisation can guarantee that every vulnerability, failure or cyberattack will be prevented. Security is a continuous process involving technology, people, suppliers, procedures and changing threats.

Statements on this page:

• are general descriptions rather than absolute guarantees
• may not apply identically to every project or system
• do not replace a signed security schedule or service agreement
• do not represent certification against a particular standard
• may be updated as systems and practices evolve.

Contact

Questions about this security page or vulnerability reporting process may be sent to:

NOVACORE AI S.R.L. Email: office@novacoresoftai.com Registered office: București, Sector 3, Strada Nerva Traian, Nr. 27–33, Birou 6, Scara B, Etaj 1, Romania