Security is built in, not bolted on.

Encryption in transit

• All traffic to natalizsoft.com is served over HTTPS with modern TLS; plain HTTP is redirected and HSTS is enforced.
• Service-to-service calls inside the platform are authenticated with short-lived, cryptographically signed identity tokens.
• Every database connection uses mutual TLS with verified, automatically rotated certificates. Unencrypted database connections are refused.

Encryption at rest

• The database, its backups and application secrets are encrypted with customer-managed keys held in a dedicated key management service, rotated automatically every 90 days.
• Passwords are never stored. We keep only a salted, memory-hard scrypt hash. Session tokens are stored as SHA-256 digests.

Network and application controls

• The database has no public IP address and is reachable only over a private network.
• The API is not exposed to the internet; only the storefront service is authorised to call it.
• A web application firewall filters common attacks and rate-limits abusive traffic at the edge.
• Strict Content-Security-Policy, CSRF protection on every form, secure HTTP-only cookies and account lockout after repeated failed sign-ins.

Payments

We do not collect, process or store payment card details on this website. Invoices are settled through a separate secure payment link.

Monitoring, logging and recovery

• Security-relevant events — sign-ins, failed sign-ins, registrations and orders — are written to an audit log.
• Infrastructure access and administrative changes are recorded in cloud audit logs.
• Automated daily database backups with point-in-time recovery.

Reporting a vulnerability

If you believe you have found a security issue, please email security@natalizsoft.com. We appreciate responsible disclosure and will respond promptly.