A factual account of how our products protect data today — including what isn't finished yet. If something isn't listed here, assume we haven't built it.
This page describes the security practices actually implemented in our products — the Member Portal and NR-BOS — verified directly against our own source code before publishing. It is not a compliance certification, and it isn't a substitute for your own due diligence.
Where something is still being finalized rather than fully built, we say so plainly, using the same status labels used elsewhere on this site.
NR-BOS: Authenticates users with short-lived JWT access tokens and rotating refresh tokens. Passwords are hashed with bcrypt — never stored in plain text. Every request is checked against one of four roles (Admin, Project Manager, Field Worker, Client), and users only see what their role permits.
Member Portal: Uses Firebase Authentication (email and password). Firestore and Storage security rules restrict each user to their own documents, cases, invoices, and files — enforced server-side, not just hidden in the interface. Admin access is restricted to Nordic Riser AB email addresses.
Both products are served over HTTPS by default — Firebase Hosting enforces this for the Member Portal, and our infrastructure does the same for NR-BOS. Cross-origin requests to the NR-BOS API are restricted to an explicit allow-list of origins, not left open to any website.
Every request to the NR-BOS API is validated, and unexpected fields are rejected outright, reducing the surface for malformed or malicious input.
Uploaded files in the Member Portal are size- and type-restricted at upload. Encryption of data at rest depends on our underlying hosting providers' own infrastructure-level encryption — we have not yet finalized and audited the specific configuration, so we aren't going to claim a level of protection we haven't verified ourselves.
We have not pursued any formal security certification (e.g. ISO 27001, SOC 2) yet.
Dependency and vulnerability scanning is not yet wired into our build process.
Brute-force protection on login endpoints, beyond password hashing, is not yet in place.
Headers such as HSTS and a Content Security Policy are not yet configured on the NR-BOS API.
The Member Portal logs case and document activity; NR-BOS itself does not yet have an equivalent audit trail.
We back up our infrastructure, but a written, tested recovery and incident-response plan is not yet finalized enough to publish here.
Found something? Tell us before anyone else — email info@nordicriser.com with what you found and how to reproduce it. We don't yet have a bug bounty program, but we take reports seriously and respond directly.
For a full list of who processes data on our behalf, see our Podprzetwarzający →