Trust begins with clear boundaries
Nova uses authenticated access, separate customer environments and least-privilege permissions. Analysts can review the evidence behind a finding. Response actions must meet the relevant access, policy and approval requirements.
Public documentation explains these principles without publishing customer configuration, private control details, credentials, or defensive information that could reduce security.
Customer-facing principles
- Access follows the approved identity, customer scope, and role for the account.
- Connections use the smallest practical access for the agreed evidence and action scope.
- Source origin, freshness, coverage, confidence, and uncertainty remain visible with the decision.
- Sensitive values are handled through protected customer and support channels.
- High-impact response actions require the relevant permissions, policies and approvals, with a record of the result.
- Review security-sensitive changes and administrative activity in the relevant audit records.
Shared responsibilities
Customers remain responsible for approving users, protecting their identity methods, defining connection and action scope, reviewing provider access, and deciding how Nova outputs enter their operating process. Hansec provides the product and support controls agreed for the deployment.
For assurance material related to a specific evaluation or agreement, contact Hansec through the approved customer channel.