Security

Last updated 12 October 2026

A workshop trusts NIVO with its customers, its cars and its money. This is how we protect them.

Where the data lives

• NIVO runs on Amazon Web Services in Stockholm, Sweden. Data, files and backups stay in the EU.
• AI models are reached through Amazon Bedrock within EU regions. Your data is not used to train them, and an administrator can switch AI off for the whole company.

Separation between workshops

• Every workshop's data is separated in the database itself: each table carries the workshop it belongs to, and the database refuses any request for another workshop's rows.
• The application connects as a role that cannot bypass that rule.
• The separation is tested automatically on every change, and proven against the live database on every release; a failure stops the release.

Encryption and access

• All traffic is encrypted (TLS 1.2 or later). Data is encrypted at rest, in the database, in file storage and in backups.
• Inside a workshop, each person sees what their role allows; the administrator decides the roles.
• Sign-in codes and links expire, and sessions end after at most 12 hours.
• Our own access to production goes through individual, time-limited sign-ins. Nothing is changed by hand: every change to the infrastructure goes through a reviewed, logged pipeline.

Backups and continuity

The database is backed up continuously and the backups are kept for 14 days, in the same EU region.

Reporting a vulnerability

If you think you have found a security problem, write to info@shanova.se. Please give us a reasonable time to fix it before telling others, and do not access or change other people's data while testing. We will answer you and tell you what we did.