You are trusting us with client photographs and money.
That deserves specifics rather than a badge wall. This page describes how Nolira is built, what we protect, and what we have not finished yet.
Encryption
Data is encrypted in transit with modern TLS and at rest by the cloud provider. Selected sensitive fields carry additional application-level protection where the threat model calls for it.
Tenant isolation
Every business record carries an organisation identifier derived from the verified session, never from client input. Repository filters, authorisation checks and tenant-aware cache keys enforce it, and automated tests specifically hunt for cross-tenant leakage.
Authentication
Short-lived access tokens with rotating refresh, device and session visibility with remote revocation, brute-force rate limiting, and re-authentication before sensitive actions such as refunds or data export.
Least privilege
Access is denied by default. Permission is combined with scope, threshold and approval, so a branch manager can approve a refund for their own outlet up to a configured limit and no further.
Audit trail
Sensitive actions record actor, effective role, device, target, before and after values, reason, approval chain, timestamp and correlation ID. Passwords, tokens and card data are never written to the audit payload.
Backup and recovery
Automated encrypted backups with point-in-time recovery, object storage versioning, and restore drills run on a schedule rather than assumed to work.
Treatment notes and photographs are not ordinary data.
Allergy records, consultation notes and before-and-after photographs can reveal a great deal about a person. Nolira treats them as a restricted class with their own access rules, retention and logging.
- Access to consultation notes and photographs is granted by role, and every view is logged
- Media is stored as a service record, not marketing material, unless separate consent is given
- Sensitive notes and photographs are excluded from analytics and product telemetry
- Exports containing sensitive data are permission-controlled and recorded
- Nolira is not a medical records system and does not store diagnoses or prescriptions
How we build
- Code review on every change, with required checks before merge
- Dependency scanning, secret scanning and static analysis in the pipeline
- Signed application builds with protected signing credentials
- Security tests covering authentication, tenant boundaries and financial flows
- Penetration testing before broad launch and periodically thereafter
- Production debugging access is controlled and time-limited
Payments
- Card payments run through a hosted payment page or tokenised provider
- Nolira never stores raw card numbers or CVV
- Payment status is confirmed through signed, idempotent provider webhooks
- Separate provider credentials per environment
Reporting a vulnerability
If you believe you have found a security issue, write to hello@nolira.my with enough detail to reproduce it. We will acknowledge receipt and keep you updated. Please give us reasonable time to fix an issue before disclosing it publicly.
What we have not done yet
Nolira is an early-stage product running paid pilots. We hold no SOC 2 or ISO 27001 certification today, and we would rather say so than imply otherwise. Enterprise single sign-on, SCIM provisioning and data residency options are on the roadmap rather than shipped.
If your procurement process requires a certification we do not hold, tell us early and we will be straight with you about whether the timeline works.
Send us your security questionnaire.
We would rather answer it properly before you buy than discover a blocker during onboarding.