Implemented safeguards
Security
Last reviewed: August 28, 2026.
This page describes implemented controls, not a guarantee that any Internet service is risk-free. Novus Stream Solutions operates the service from London, Ontario, Canada.
Accounts and sessions
The advanced beta uses Better Auth email/password authentication. Passwords must be 12 to 128 characters and are stored through the authentication provider's password-hashing flow, not as plaintext. Production cookies are HTTP-only, Secure, SameSite=Lax, and path-scoped. Authentication endpoints use database-backed rate limiting, banned accounts cannot create sessions, and post-authentication redirects reject cross-origin and encoded redirect bypasses.
Tenant and administrator boundaries
Workspace queries resolve the authenticated user's active organization on the server and include that organization in private-data predicates. Public market queries use a separate server-only boundary over provider observations and never select tenant purchases, imports, account records, sessions, or raw provider payloads. Administrator routes require both an administrator account role and an administrator or owner tenant role. The first administrator can only be bootstrapped once by the configured matching email.
Ingestion and provider safety
Scheduled ingestion accepts only allowlisted provider identifiers and a server-side cron bearer secret. Secret comparison is timing-safe. Provider runs use leases, bounded batches, checkpoints, idempotent writes, failure isolation, and capacity guards. Browser clients never receive provider API keys or database credentials.
Browser and transport controls
Production responses enforce HTTPS with HSTS, reject MIME sniffing and framing, restrict permissions such as camera, microphone, geolocation, and payment, and send an enforced Content Security Policy. Because Adsterra uses rotating HTTPS hosts and its banner loader evaluates script during impression registration, advertising-eligible public pages currently require broader HTTPS and script execution allowances than the authenticated workspace would otherwise need. Ads remain production-host, route, region, and consent gated; no untrusted HTML is rendered by Novus.
Privacy and incident response
Sensitive authenticated and export responses are marked private and no-store. Optional analytics and advertising follow the choices described in the Cookie Policy. Novus keeps breach records and will assess notification and reporting duties under applicable law if a security safeguard fails.
Report a vulnerability
Email support@novusstreamsolutions.com with “Security” in the subject, the affected URL, reproducible steps, and demonstrated impact. Test only with your own accounts and data, avoid service degradation, do not access another tenant, and allow reasonable time for remediation. There is currently no paid bug bounty.