We'd rather tell you exactly what we do than list badges. We don't currently hold security certifications, and we won't imply that we do.
This website
- Encrypted everywhere. The site is served only over HTTPS.
- Minimal data. The contact form asks for three required things. Our logs record that a message arrived, not who sent it or what it said.
- Bot and abuse protection. Submissions are rate-limited per visitor, filtered for automated spam, and checked by Cloudflare Turnstile.
- No trackers by default. No advertising or cross-site tracking. Optional third-party content loads only after you allow it (see our cookie policy).
- Few providers. A short list of well-established providers, listed in our privacy policy.
- Checked on every change. Automated tests, dependency checks and accessibility checks run before changes ship. Unpublished drafts are verified not to appear in public files.
In client work
These are the practices we already describe in how we work:
- Only what the work needs. We agree how data will be handled before a project starts.
- Every automated step logged, so AI and automation decisions are traceable and replayable.
- A human checks anything customer-facing before it's sent. See Responsible AI.
- Clean handover. Documentation and access are handed over properly at the end of a project.
Reporting a vulnerability
If you think you've found a security issue in this website, please email mohammad.ashraf@nuvai.qa with the details and how to reproduce it. Please don't access other people's data, disrupt the service, or disclose the issue publicly before we've had a chance to fix it. We'll acknowledge your report and keep you updated.
Contact
Security questions: mohammad.ashraf@nuvai.qa