Security

1. The short version: your files stay put

Most Novus apps do their work in your browser. When you remove a background, convert a file, compress an image, fill a PDF or generate a visualiser, the file is read by JavaScript and WebAssembly running on your own machine. It is not uploaded to a server, not queued, and not stored. There is no copy of it for us to lose.

That is a security property, not a marketing line: the most reliable way to avoid a data breach is to never hold the data. Where an app does need a network call, the documentation for that app states exactly what leaves the browser.

2. What we do not hold

• No accounts and no passwords on this hub. There is no sign-up, no login and no credential store here, so there is no password database to breach.
• No payment data, ever. The apps are free and ad-supported. We do not take card details, and no payment processor is embedded on any page.
• No uploaded user files for browser-first processing — see section 1.

3. Transport and browser hardening

Every response from this site carries the following headers:

• Strict-Transport-Security — HTTPS only, for two years, including subdomains, and submitted to the browser preload list. Plain HTTP is not an option.
• X-Content-Type-Options: nosniff — browsers must respect the declared content type rather than guessing it.
• Referrer-Policy: strict-origin-when-cross-origin — the full path of the page you came from is never sent to another site.
• X-Frame-Options: SAMEORIGIN and frame-ancestors — the site cannot be framed by a third party, which is what clickjacking needs.
• Permissions-Policy — camera, microphone, geolocation, payment, USB, accelerometer and autoplay are all denied at the document level.
• Cross-Origin-Opener-Policy: same-origin-allow-popups — isolates this document from windows that open it, while still allowing a legitimate ad click-through to open.

Content-Security-Policy is currently report-only. We publish a full policy — restricting scripts, frames, connections and form submissions to a named allowlist, with object-src ‘none’, base-uri ‘self’ and form-action ‘self’ — but it is sent as Content-Security-Policy-Report-Only, which means violations are reported and not blocked. It is stated plainly here because a policy in report-only mode is instrumentation, not a defence. Promoting it to enforcing is open work, gated on the third-party advertising and consent scripts staying inside the allowlist.

4. Third parties

Two third parties run code on these pages: Google AdSense for advertising and Google Analytics 4 for aggregate traffic measurement. Both are consent-gated by region, and in the EU, EEA, UK and Switzerland neither loads until you accept. The cookie policy lists every cookie and storage key, and the privacy policy covers what is and is not collected.

5. Reporting a vulnerability

Email support@novusstreamsolutions.com with “Security” in the subject line. Please include the affected URL, the steps to reproduce, and what an attacker could actually achieve. A proof of concept helps more than a scanner score.

In scope: novusstreamsolutions.com and the 7 live product subdomains. Out of scope: findings that only affect third-party advertising frames, reports generated purely by automated scanners with no demonstrated impact, missing headers on assets that carry no data, and denial of service.

What we ask: test only against your own browser and your own data, do not run automated scans heavy enough to degrade the service for other people, and give us a reasonable chance to fix the issue before publishing it.

What you can expect: an acknowledgement, an honest assessment of severity, and a fix or a stated reason we are not fixing it. We are a small independent operation — there is no bug bounty and no monetary reward, and saying so up front is fairer than leaving it implied. Credit in the changelog is offered if you want it.