VERSION 1.8 · LAST UPDATED: 4 OCTOBER 2026
Your procurement data (routes, prices, carriers) is a trade secret. This page explains how we protect it and where we stand. Your information security team can request the detailed security pack and questionnaire answers at info@navluno.com.
ISO/IEC 27001 status. Navluno is not yet ISO/IEC 27001 certified. We have mapped our technical and organisational controls to ISO/IEC 27001:2022 Annex A and show below which controls are in place and which are planned. Our infrastructure provider Railway holds a SOC 2 Type II report.
| Area | Status | Details |
|---|---|---|
| Hosting | In place | Railway (SOC 2 Type II). Servers and data are in the European Union (Amsterdam, the Netherlands). |
| Encryption in transit | In place | HTTPS (TLS) only. HSTS for one year; browsers never fall back to plain HTTP. |
| Company isolation | In place | Each company runs in its own application process and data folder. Workspace cookies are signed. |
| Sign-in security | In place | Passwords stored with bcrypt, minimum 10 characters. Two-factor authentication (authenticator app or passkey). Limits on failed attempts. |
| Sessions | In place | At most 8 hours; closed after 120 minutes of inactivity. HttpOnly, Secure, SameSite cookies. |
| Role-based access | In place | Admin, Procurement, Operations. Permissions are enforced on the server, not only hidden in the interface. |
| Audit log | In place | Sign-ins, permission changes, requests, awards, documents and data exports are logged. Entries are hash-chained (SHA-256), kept for 24 months and exportable as CSV. |
| Backups | Partly | Automatic daily backups (14 days). Encrypted (AES-256) daily offsite backups at a separate provider are built and being rolled out. |
| Application security | In place | Content Security Policy, framing ban, cross-site request protection, output escaping. Automated security tests before every release. |
| Dependency scanning | In place | npm audit on every release; no known vulnerabilities as of 4 October 2026. |
| Single sign-on (SSO) | In place | Microsoft Entra ID (OpenID Connect) and Google sign-in. A company can turn password sign-in off; account deactivation and multi-factor authentication follow its own Entra policies. SAML 2.0 is planned. |
| ERP / SAP integration | In place | Read-only API with company-specific keys: requests, quotes, the awarded carrier, SAP vendor number and SAP reference. Keys are shown once, only their hash is stored, and every read is written to the audit log. |
| Independent penetration test | Planned | To be carried out by an external firm; a summary will be shared on request. |
Some organisational controls will be completed once the company and its information security management system (ISMS) are established.
| Control | Status |
|---|---|
| 5.15–5.18 Access control, identity and access rights | In place |
| 5.23 Information security for cloud services | Partly |
| 5.24–5.28 Incident management | Partly |
| 5.29–5.30 Disruption and business continuity | Partly |
| 5.34 Privacy and protection of PII | Partly |
| 7.1–7.14 Physical security | At provider |
| 8.5 Secure authentication | In place |
| 8.8 Management of technical vulnerabilities | In place |
| 8.13 Information backup | Partly |
| 8.15 Logging | In place |
| 8.16 Monitoring activities | Partly |
| 8.24 Use of cryptography | In place |
| 8.25–8.29 Secure development and security testing | In place |
| 8.32 Change management | Partly |
| 5.1–5.4, 6.1–6.6 Policies, roles, people | With the company |
If you believe you have found a security issue, email info@navluno.com with the subject "Security". We reply within two business days and will not take legal action over good-faith reports.