Hosting
Hosted on Hetzner. Data and encrypted backups are kept in EU regions: Hetzner's Falkenstein datacenter in Germany and Backblaze B2 in the EU.
Security at Nomli
Tenant isolation
Schema-per-tenant on shared Postgres instances; SET LOCAL search_path enforced per request.
Encryption
All traffic is served over HTTPS. Customer contact details sit in a shared, multi-tenant database; database backups are encrypted on our servers before they ship off-site, and passwords, one-time codes, and session tokens are stored only as one-way hashes.
PCI scope
Payment card numbers are never stored on our systems. Orders launch cash on delivery; when online card payments are added, they run through a certified PCI-DSS-compliant provider that handles the card details directly. Subscription billing is settled by bank transfer, so no card details are held for it either.
Sub-processors
The current sub-processor list is published in the privacy policy, with 30-day notice before additions.
Reporting issues
Security disclosures: security@nomli.co.