Security architecture
Our security approach is designed around defense in depth and least privilege. Depending on the Service, controls may include encryption in transit and at rest, environment separation, secrets management, API authentication, secure session handling, and production access controls.
Identity and access controls
- Role-based access control and least-privilege permissions
- Multi-factor authentication where available and appropriate
- Access reviews, credential management, and prompt removal of unnecessary access
- Authenticated API access and secure session controls
- Administrative activity logging and monitoring
Data protection
We apply safeguards appropriate to the sensitivity of the information and the Service configuration. We seek to minimize the collection and retention of sensitive data, maintain secure backups, and use service-provider and integration controls to reduce unnecessary exposure.
Novera principle: We do not store Equifax credentials or consumer credit data unnecessarily. Where an authorized provider’s service supports provider-hosted storage or retrieval, Novera is designed to use that model instead of becoming a warehouse of raw credit reports.
Security operations
Security operations may include vulnerability management, dependency and configuration review, logging, monitoring, backup and recovery testing, vendor evaluation, environment separation, and change-management practices. The exact controls and commitments for a customer deployment are established in the applicable order form, security addendum, or data-processing agreement.
Incident response
We maintain incident-response procedures intended to identify, contain, investigate, remediate, and communicate security incidents. If an incident affects Customer Data, UnifiTechs will provide notice and cooperation as required by applicable law and the governing agreement.
To report a suspected security issue, contact security@unifitechs.net. Please do not include live credit reports, credentials, or other sensitive personal information in an initial report.
Novera-specific protections
Novera’s intended design includes explicit consumer authorization, identity verification, provider-controlled access, role-based access, audit logging, limited data sharing, retention controls, and consumer deletion and correction workflows. Product availability and the final control set depend on the selected provider services and production implementation.
This page describes a security program and product design commitments at a high level. It is not a certification, audit report, warranty, or substitute for a customer-specific security review.