Security Overview

Scope and approach

This overview describes the security approach for Novi Most LLC's roofing estimate software. Novi Most uses reasonable safeguards designed to protect Service information, recognizing that risks change and no small software provider or hosted system can guarantee prevention of every incident. This summary does not represent a certification, independent audit, or warranty of uninterrupted or breach-free service.

Company separation and access

Customer information is associated with a company account and access is intended to be logically separated by company and available roles. Shared managed hosting and database infrastructure is used; Novi Most does not promise a physically dedicated database, server, or storage environment for any Customer. Admin and non-admin roles support different functions, and access is intended to be limited to authorized Users. Novi Most personnel or scoped providers may access information when reasonably needed to operate, secure, or support the Service or comply with law.

Accounts, transport, and hosting

The Service is hosted on Replit managed infrastructure in the United States based on current arrangements. Website connections use HTTPS. Account credentials and access controls are used to support authentication; password credentials are not intended to be stored as plain-text passwords. The Service uses role-based permissions and security measures designed to reduce unauthorized access. Stripe-hosted billing handles payment card entry; Novi Most does not receive full card numbers through the Service.

Files, sharing, and analytics

Users may generate estimate documents and send them to intended recipients. Customers should verify recipient addresses and any available sharing settings before distributing a document. Novi Most does not claim that every stored file or shared link is authenticated, private to a single named recipient, or protected against forwarding; actual access depends on the feature and configuration. Customer logos may be included in outward-facing branded documents and are intended for use as public brand assets.

Replit provides platform analytics that may include pageview or usage information. Novi Most's custom event emitter excludes private routes, but that does not establish that platform-level analytics never record private-route visits. The public site may load assets from jsDelivr, which receives ordinary network connection details.

Providers and incident contact

Replit, Stripe, Resend, optional Twilio, and jsDelivr have the roles described in the Subprocessors attachment. Roof measurement reports are parsed locally by the current Service workflow, not sent to an external AI parser. Novi Most maintains an internal incident response procedure and will notify affected Customers as provided by the DPA and applicable law. Report suspected vulnerabilities or unauthorized access promptly to admin@novimost.app. Please provide reasonable time to investigate and do not access another customer's information.

Limitations and certifications

Novi Most does not promise that unauthorized access, error, outage, data loss, or other security incident will never occur. It does not promise specific backups, recovery time objectives, recovery point objectives, encryption at rest, a dedicated database, or automatic export or deletion. Novi Most does not currently claim SOC 2 or ISO 27001 certification. Its safeguards may change, but Novi Most intends to maintain a reasonable overall level of protection.