Engineered for institutional trust from day one.
Security at NovaStack Group LLC is enforced directly in our shared monorepo chassis, automated CI verification gates, and production cloud policies across all portfolio ventures.
Strict Multi-Tenant Isolation
All multi-tenant SaaS platforms operated by NovaStack Group LLC enforce server-side Actor scoping and organization_id isolation at the database repository boundary—never relying on client-side UI checks.
Envelope Encryption & Secret Hygiene
Third-party OAuth tokens and API credentials across our portfolio are protected via AES-256-GCM envelope encryption backed by Cloud KMS. Automated CI scanners block plaintext secrets before commit.
Edge Validation & Least Privilege
Every external API boundary validates payloads via strict Zod contracts, enforces idempotency keys on mutations, and restricts storage rules (including write-only intake endpoints) to minimum required permissions.
OWASP ASVS & 12-Factor Parity
Authorization roles live authoritatively in managed databases with verified email ownership checks, audit logging, and zero environment-conditional authentication backdoors.
Responsible Vulnerability Disclosure Policy
If you believe you have discovered a security vulnerability in novastackgroup.com or any NovaStack Group LLC subsidiary property (FlockPush, HOAReady, BhaktiLoop, HostPartyPlay, or MROStack), please report it confidentially to security@novastackgroup.com.
Please include reproduction steps, affected URLs, and impact assessment. We acknowledge good-faith reports promptly and ask that researchers allow reasonable remediation time prior to public disclosure.