Your catalog, your property. Always.
Servers in Europe, encrypted connections, encrypted credentials and files, and your GDPR rights one email away. This is how we protect what you entrust to us.
Noobit is an early-stage company. We do not have formal SOC 2 or ISO 27001 audits yet. We use the principles of those standards as internal guidance, but until we are certified we do not display them as a badge. We prefer honesty over marketing. If your organization explicitly needs them, let's talk — we can plan certification as part of an Enterprise agreement.
How we store your data.
Servers in Europe
Our servers and database are in Germany (Hetzner). We use AI providers for writing, research and image processing. On the Economy AI level, product pages and their Product Knowledge are written with models hosted in Europe (NPAW). Web research, images, the scanner and the Pro level use OpenAI and Google, which process data in the United States. We list them below as sub-processors.
Encrypted connections
Your connections to Noobit are encrypted (HTTPS), with HSTS enabled.
Encrypted credentials and files
The credentials of your connections are encrypted (AES-256) at the application level; image and file storage (Cloudflare R2) is encrypted at rest.
Each customer, isolated
Every query is filtered by your account: your data is never mixed with other customers' data.
Role-based permissions
Each person on your team signs in with their role (owner, manager, editor or viewer) and can only do what that role allows: an editor writes, but does not publish. Passwords are never stored in plain text.
Continuous backups
The database is backed up continuously off the server (Cloudflare R2), and a full backup is also made every day. Restoring has been tested.
Action audit log
A log of your team's changes, with user and date. No one edits it.
Orders without personal data
If you connect your store, we store your orders to know what is selling. You can turn on a setting so that we do not store the buyer's name or email: only a pseudonym.
Six rights. Exercise them whenever you want.
To exercise any of your rights, email us at [email protected] and we will handle it without delay.
Sub-processors.
These are the providers that may process your data as sub-processors. We use them under their business offerings; transfers outside the European Economic Area (EEA) rely on the EU-U.S. Data Privacy Framework or on standard contractual clauses. We notify customers 30 days in advance before adding or changing any of them.
Questions about security?
For technical details or any compliance requirement specific to your organization.