Security Policy

This policy describes how FortifAI Limited, which operates NOL8 (“we”, “us”, or “our”), protects the data entrusted to us across our website, products, and infrastructure.

NOL8 is part of FortifAI Limited, listed on the ASX as FTI. We handle data in Australia, Israel, and the United States.

Our approach

We design our products and operate our infrastructure to protect the confidentiality, integrity, and availability of data. We apply defense in depth, least privilege, and ongoing review across the organization.

Data protection

• Encryption in transit. Data exchanged with our services is encrypted using current industry-standard protocols.
• Encryption at rest. Data we store is encrypted at rest.
• Data handling in the product. Where our product processes data in flight, we limit retention to what is required for the service and operate under the terms agreed with each customer.

Access control

• Access to systems and data is granted on a least-privilege, need-to-know basis.
• Strong authentication, including multi-factor authentication, is required for access to sensitive systems.
• Access is reviewed periodically and removed promptly when no longer needed.

Infrastructure and network security

• Production systems are segregated and protected by network controls and monitoring.
• Changes to production follow a controlled process with review.
• We maintain logging and alerting across critical systems.

Monitoring and incident response

We monitor our systems for security events and maintain an incident response process. In the event of a security incident affecting your data, we will respond promptly and provide notice in line with our contractual and legal obligations.

Compliance and certifications

We align our controls with recognized security standards. Our current certifications and audit status are in progress.

Personnel

• Staff are subject to confidentiality obligations.
• We provide security awareness training and apply appropriate screening where permitted by law.

Responsible disclosure

We welcome reports from security researchers. If you believe you have found a vulnerability in our systems, please contact us at [email protected] with enough detail to reproduce the issue. We ask that you:

• Give us a reasonable opportunity to investigate and remediate before public disclosure.
• Avoid accessing, modifying, or deleting data that is not yours, and avoid degrading our services.
• Act in good faith and within the law.

We will acknowledge reports made in good faith and will not pursue action against researchers who follow this policy.

Contact

For security questions or reports, contact [email protected].