Security & Breach Notification

Last updated: 22 September 2026

This page describes, at a high level, how we protect personal data on noori pro and what we commit to if a security incident occurs. In line with good security practice, we intentionally do not publish implementation or architecture details that could help an attacker; artists with an active Data Processing Agreement can request more detail under confidentiality by emailing hello@noori.pro.

1. How We Protect Data

• Encryption in transit (HTTPS/TLS) across the platform
• Encrypted data storage at rest, provided by our database infrastructure
• Passwords are hashed and never stored or logged in plain text
• Row-level access controls, so an Artist can only access their own data
• Bot and abuse protection (CAPTCHA) on authentication-related forms
• Role-based access to production systems, limited to those who need it
• Regular dependency and platform updates to address known vulnerabilities

2. Our Internal Incident Response Process

We follow a documented internal process covering severity assessment, containment, evidence preservation, identifying affected data and users, a legal risk assessment, the notification decision itself, remediation, and a postmortem. Consistent with good security practice, we don't publish the runbook itself; Artists with an active Data Processing Agreement can request more detail under confidentiality. The commitments in Section 3 below are what that process exists to meet. [This process has not yet had legal review, and currently relies on a one-off legal consult if a real incident's notification obligations are unclear - that gap should close before the process is relied on for anything beyond a small beta.]

3. Breach Notification Commitments

If we become aware of a security incident that results in accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data (a "breach"), we will:

• Investigate and take steps to contain and remediate the breach
• Where UK GDPR applies and the breach is likely to result in a risk to individuals' rights and freedoms, notify the UK Information Commissioner's Office (ICO) without undue delay and, where feasible, within 72 hours of becoming aware of it
• Notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms
• Notify affected US individuals and, where required, state regulators, in accordance with the applicable state breach notification law for their state of residence
• Notify affected Artists promptly where a breach affects data we process on their behalf as a processor, so they can meet their own notification obligations as controller

4. Reporting a Security Issue

If you believe you have found a security vulnerability in noori pro, please report it to hello@noori.pro rather than disclosing it publicly, so we can investigate and fix it. We will acknowledge good-faith reports and keep you updated on our progress.