Policies and Disclosures

01 Purpose and contract hierarchy

This page gives customers and visitors a clear view of important limits. It is not an Order, service level agreement, data processing agreement or statement of work.

The mutually accepted agreement governs a Nova evaluation, paid platform access and any professional or managed service. If public copy differs from that agreement, the signed agreement controls the service relationship.

02 Security limitations

Results depend on connected sources, evidence coverage, configuration, granted permissions, data quality, environment changes and customer action. Missing or incomplete evidence is not proof of low risk, security or compliance. A quiet console is not proof that no activity occurred.

A finding, score, recommendation or assessment reflects the evidence and scope available at that time. It may change when new evidence arrives or the environment changes. Customers remain responsible for their security program, legal duties, backups, continuity planning and final decisions.

03 Nova product boundaries

Nova connects cloud-security and security-operations evidence, analysis and governed workflows. Available functions depend on the licensed scope, supported connections, customer configuration and evidence actually received.

Nova outputs are decision support. They can be incomplete or wrong and require validation appropriate to their impact. They do not replace an analyst, incident commander, auditor, lawyer or regulator.

Nova does not guarantee a detection gap, complete telemetry, complete attack coverage, autonomous remediation or a specific security outcome unless an applicable signed agreement states a precise commitment.

04 Qyronis and Proactive Hunting

Qyronis learns entity behavior baselines and identifies meaningful deviation, progressive intent, material trajectory changes and emerging risk. It is a behavioral intelligence layer, not an alert generator.

Proactive Hunting starts from retained alert windows to form correlated behavior hypotheses, then searches the available event corpus for recurrence, supporting evidence and matching activity that was not linked to an alert. It can produce governed suggestions, executions, findings, Hunt Insights and reports within the available scope.

The connection is selective. A qualified Qyronis signal may help prioritize a hunt, but Qyronis alone never creates one and temporal noise is not elevated on its own. Every candidate must pass independent qualification and validation. Unalerted matching activity requires validation and is not, by itself, proof of a detection gap.

Qyronis asks what behavior is deviating and where it may be heading. Proactive Hunting asks whether correlated behavior recurs in the broader available corpus, what evidence exists beyond retained alert linkage, and what an analyst should validate next.

05 Automated analysis and response

Nova performs bounded analysis, scoring, behavior assessment, detection drafting and supported workflows. Automated output may contain error or uncertainty. Material decisions should use the attached evidence, current scope and customer procedures.

A supported response action runs only when allowed by customer policy, granted access and the approval gate that applies to that action. Active containment and other higher-impact actions are approval-gated. Nova does not grant itself authority in a customer environment.

Hansec does not publish internal thresholds, model or prompt metadata, source-identity mechanics, credentials or customer-specific security details on this website.

06 Customer data boundaries

Nova is designed to enforce tenant-scoped access and authorization. Customer data handling, customer-specific learning, permitted aggregate analysis, provider use, retention and data locations follow the applicable agreement, documented configuration and privacy safeguards.

One customer’s raw data is not intended to be exposed to another customer. No public statement on this page expands customer-data use beyond the signed agreement or the Privacy Policy.

07 Integrations, previews and roadmap

An integration depends on the third-party provider, supported interface, customer license, permissions and configuration. A provider change may limit or interrupt it. Hansec does not control a third party’s service, security, pricing or terms.

A feature clearly labelled preview, beta, early access or experimental may change, be limited or be withdrawn. It has no service level commitment unless a signed agreement expressly provides one.

A roadmap, demonstration or future-looking statement describes current direction. It is not a purchasing commitment and should not be treated as a promised delivery date.

08 No legal advice or certification

Website content, framework mappings, scores, reports and recommendations are not legal, regulatory, audit, insurance or financial advice. A mapping to a control or framework does not certify compliance and does not replace evidence required by an auditor or authority.

Customers should use qualified advisers for breach notification, regulatory filings, legal duties and formal assurance.

09 Commercial terms and accessibility

Pricing, renewal, cancellation, refunds, service credits, support coverage and post-termination handling follow the applicable signed agreement. This website does not create a separate online refund or cancellation promise.

Hansec aims to make the website usable with common assistive technology and to improve identified barriers. We do not claim a formal accessibility certification or complete conformance. Report a barrier through our support channel and include the page and the problem encountered.

10 Cookie preferences

The current first-party cookie and local-storage inventory appears in the Privacy Policy. Optional categories are off until selected. You may change them below.

11 Vulnerability disclosure

Report a suspected vulnerability through our security channel. Include the affected Hansec-owned asset, impact, safe reproduction details and your contact information. Do not include customer data, credentials or unnecessary personal data.

Do not disrupt service, access data that is not yours, use social engineering, deploy malware, exfiltrate data or make a vulnerability public before coordinating with Hansec. Stop if you encounter customer or personal data.

Hansec will assess a good-faith report and coordinate next steps appropriate to the issue. We do not promise a bounty, a fixed remediation date or public recognition.

12 Changes and contact

We may update these disclosures as the website, Nova or our practices change. A signed agreement can be changed only under its own amendment terms.