Security at Roovie

Version 1.0 · Last updated: October 29, 2026

Need a completed security questionnaire or our security overview? Email legal@roovie.com.

1. Our Approach

1.1 Who we are. Roovie is provided by NanoTech Inc., DBA NanoTech Materials Inc. ("NanoTech"). This page explains how NanoTech protects the data customers entrust to Roovie, where that data lives, and where our security program is heading. The binding commitments are in the Data Processing Addendum at https://www.roovie.com/legal/dpa; where this page and that addendum differ, the addendum governs.

1.2 SOC 2. NanoTech is preparing for a SOC 2 Type 2 examination by an independent CPA firm, covering the Security and Confidentiality criteria. The report is targeted for the third quarter of 2027. Until it is issued, we answer security questionnaires, share summaries of our security policies under a confidentiality agreement, and provide a written security overview on request.

2. Where Your Data Lives

2.1 United States hosting. Roovie runs in the United States: the web application and API on Heroku (Salesforce), the database and its backups on MongoDB Atlas, files and results on Amazon Web Services, and simulation computing on a dedicated Hetzner server in Ashburn, Virginia. Each of these providers holds independent security certifications such as SOC 2 or ISO 27001.

2.2 Subprocessors. Every company that processes customer personal data for Roovie, what it does, and where, is listed at https://www.roovie.com/legal/subprocessors. We give customers at least 30 days' notice before adding one.

3. Protecting Data

3.1 Encryption. Data is encrypted in transit using TLS, with HTTP Strict Transport Security on the application and API, and encrypted at rest in the database and file storage. Application secrets are encrypted with keys managed in AWS Key Management Service.

3.2 Separation between customers. Each organization's data is tagged with that organization, and every request is checked against the signed-in user's membership. Automated checks in our build pipeline stop new code that skips that check.

3.3 Simulation computing. Simulations run in containers with an unprivileged user, no extra Linux capabilities, and fixed CPU, memory, and process limits, reachable only through an encrypted proxy.

3.4 Data we do not want. Roovie is not designed for health, payment-card, biometric, children's, or export-controlled data. Payments are processed by Stripe; NanoTech never stores full card numbers.

4. Access

4.1 Your users. Sign-in is handled by Clerk, our authentication provider; passwords are never stored in Roovie's database, and users can turn on multi-factor authentication. Customer administrators assign roles, and permissions are checked on each action. Organization-wide multi-factor enforcement and enterprise single sign-on are on our roadmap.

4.2 Our staff. NanoTech staff access is limited to what each role needs, uses named individual accounts, and requires multi-factor authentication on administrative consoles. Support access and other administrative actions are recorded in an audit log.

5. Building Roovie Securely

5.1 Changes. All code is kept in version control, and every change runs automated tests and security checks before release, including secret scanning, dependency vulnerability audits, and checks that customer routes are scoped to their organization. Releases follow a documented procedure with zero-downtime deploys and fast rollback.

5.2 AI-assisted development. Our engineers use AI coding assistants under direct supervision. AI-written changes pass through the same tests, checks, and review as any other change, and AI tools hold no production credentials.

5.3 Testing. We completed an internal security review of the application, API, and simulation engine in October 2026 and released its fixes. An independent penetration test is scheduled for early 2027.

6. Monitoring and Abuse Protection

6.1 Logging. Administrative actions, role and membership changes, settings changes, and support impersonation are logged.

6.2 Limits. Per-organization request limits, simulation limits, and bot protection on public forms guard against abuse, and AI use is capped per organization, per user, and per run.

7. Continuity and Incidents

7.1 Backups. The production database is backed up automatically by MongoDB Atlas, and the web application and database run on managed platforms with provider-level redundancy.

7.2 Incidents. NanoTech keeps an incident response procedure covering detection, containment, recovery, and review. We notify affected customers of a security incident involving their personal data without undue delay, and in any event within 72 hours, as the Data Processing Addendum provides.

8. Privacy and AI

8.1 Your data and AI. Our AI providers, OpenAI and Anthropic, are used through their business services and may not use customer data to train or improve their own models. NanoTech uses project data to improve Roovie only within the limits of the Data Processing Addendum, after removing or de-identifying personal data.

8.2 Retention and deletion. Customer data is kept for the life of the account; after access ends it is archived for 30 days for export and then deleted, including by our subprocessors. How we handle personal information is described at https://www.roovie.com/privacy.

9. Contact

9.1 Reporting a problem. Please report a suspected vulnerability or security incident to legal@roovie.com. Good-faith reports are welcome, as our Acceptable Use Policy at https://www.roovie.com/legal/acceptable-use describes.

9.2 Questionnaires and documents. For a security questionnaire, the security overview, policy summaries, or a call with our security lead, email legal@roovie.com.