Security at Nova Solutions (Pvt) Ltd

We build software for a living, so we treat the security of our own website seriously. This page explains the main protections we use and how you can help us keep the website safe.

Our website is built with the following safeguards:

• Encrypted connections (HTTPS) protect data sent between your browser and the website.
• The administration area is restricted to authorised staff and requires a signed-in, approved account. Public self-registration is disabled.
• Database access rules ensure that only administrators can read contact messages or change website content.
• Contact form entries are validated for type and length, and hidden spam traps help block automated submissions.
• Image uploads use short-lived signatures created on our server, and the server confirms the user is an administrator before allowing an upload.
• Secret keys are stored on the server and are never included in the code sent to your browser.

Contact messages and site settings are stored in Google Firebase (Firestore). Project images are stored with Cloudinary. Both are established providers with their own security programmes. Access to our accounts with these providers is limited to authorised staff.

You can help keep your information safe by following these tips:

• Never send passwords, payment card numbers or other highly sensitive data through the contact form or by ordinary email.
• Check that the address in your browser is novasolutions.lk before entering any information.
• Be careful with emails claiming to be from us that ask for money or login details. If in doubt, contact us using the details on this website.

If you believe you have found a security issue on this website, please email hello@novasolutions.lk with the subject "Security Report". Include the page or URL affected, the steps to reproduce the issue and, if possible, screenshots.

To help us fix it safely, please:

• Give us a reasonable time to investigate and fix the issue before sharing it publicly.
• Do not access, change or delete data that does not belong to you.
• Do not disrupt the website, for example with denial-of-service tests or spam.
• Do not use social engineering against our staff or clients.

We appreciate good-faith research that follows these guidelines. We will acknowledge your report within a reasonable time and keep you updated on the outcome.

If a security incident affects personal information, we will investigate promptly, take steps to contain it and notify affected people and the relevant authorities where the law requires us to do so.

Security practices change over time. We will update this page when our safeguards change in a meaningful way. The "Last updated" date shows the latest revision.