Security

Enterprise-grade security

In-depth security audit: penetration testing and code review across the whole platform.

9.5/10
Security audit score
Penetration test & code review 路 May 2026
IBAN / BIC encryption
AES-256-GCM
2FA TOTP
Google Authenticator
Revocable JWT
session_version
Logout revocation
instant
Rate limiting
anti brute-force
OWASP headers
HSTS 路 CSP 路 nosniff
FAQ

Frequently asked questions about security

What to know about how Nebufact protects your data.

Where is my data hosted?

In France. All data is hosted on servers located in France and compliant with GDPR. Bank details (IBAN/BIC) are encrypted with AES-256 and access is protected by two-factor authentication (2FA TOTP).

How are my sessions protected?

Every session token is revocable: logging out invalidates it instantly, and a global session_version lets you revoke every open session at once if a device is lost or compromised.

What protects Nebufact against brute-force attacks?

Rate limiting on authentication endpoints, together with OWASP-recommended security headers (HSTS, Content-Security-Policy, X-Content-Type-Options: nosniff) applied across the platform.