numa
Request a demo

Legal

Security

How your data is hosted, protected and backed up, and what you can check for yourself.

Version dated
24 September 2026
Publisher
Velix Digital
  • Hosted by Hostinger, ISO/IEC 27001:2022 certified, of which we are an official partner.
  • One dedicated database per customer, on servers located in France.
  • Encrypted connections, hashed passwords, automatic backups.
  • Roles and permissions per user; connected devices visible and remotely signed out.
  • Support only accesses your data with your consent.

Our approach

Your invoices, cash, inventory and payslips are the most sensitive things your company owns. This page describes the measures actually in place to protect them, without jargon. It is updated with every change.

Hosting and isolation

  • Hosting provider: Hostinger International Ltd, a company established in the European Union and subject to the GDPR. Servers located in France.
  • One dedicated database per customer: your data is never mixed with another company’s.
  • Separate demo environment, filled only with fictional data. The screens on this site never show a customer’s data.

Our hosting provider: Hostinger

Hostinger Partner

Velix Digital, the publisher of Numa, is an official Hostinger partner (Hostinger Partner Program). We work directly with the hosting provider, and our account benefits from its priority technical support.

Security works on two levels. Hostinger protects the infrastructure: the buildings, the servers and the network. We protect the application: accounts, permissions and your data. On the infrastructure side, here is what Hostinger publishes and has verified by independent bodies:

  • ISO/IEC 27001:2022 certified, the international reference standard for information security management. The certification is issued by TÜV Thüringen, a German certification body, and can be verified with it.
  • PCI DSS v4.0.1 compliant (the security standard required by card payment networks) and compliant with the European GDPR.
  • Data centres under 24/7 surveillance, with security guards and redundant systems.
  • Anti-DDoS protection, web application firewall, intrusion detection and continuous anti-malware scanning of the servers.
  • 24/7 server monitoring by Hostinger’s in-house team, and a business continuity plan in case of incident.

Sources: Hostinger Trust Center (certifications and security controls) and “Your business is safe with Hostinger: we’re ISO 27001 certified”, Hostinger’s official blog.

Encryption

  • All connections to the site, the application, the mobile apps and the API are encrypted (HTTPS / TLS). The site enforces HTTPS (HSTS).
  • Passwords are hashed with an algorithm designed for it (bcrypt): nobody, not even our team, can read them.
  • Backups are stored in a space separate from the application.

Backups and continuity

Each customer database is backed up automatically and regularly by the hosting provider, in a space separate from the application. A restore can be requested from support. Independently of our backups, you can export all your data to Excel and PDF at any time, free of charge.

Access and authentication

  • Named credentials: no shared accounts. Every action is attributed to a user.
  • Roles and permissions: each user only sees the menus and data of their job (management, sales, warehouse, accounting…). The customer’s administrator manages them directly.
  • Connected devices: each session is tied to a device; the list is visible and any device can be signed out remotely.
  • Automatic expiry of inactive sessions, rate limiting of login attempts and API calls.

Traceability

Documents (quotes, purchase orders, invoices, payslips) keep the history of their statuses, approvals and signatures, with author and time. Logins are logged. If an operation is ever in doubt, you know who did what, and when.

Development and updates

A new version is released roughly every three weeks. Each version is tested on a separate environment before production, then deployed at night without service interruption. Software components are kept up to date to fix known vulnerabilities.

Confidentiality of your data

  • Support accesses your data only with your consent, for the duration of the intervention.
  • Our team is bound by confidentiality.
  • Your data is never sold, rented or used for any purpose other than the service. You remain its owner.

Reporting a vulnerability

Found a flaw? Write to contact@numa.ma with the subject “Security”. We acknowledge receipt within 48 business hours and keep you informed of the fix. We ask you not to access other customers’ data and not to disclose the flaw before it is fixed.

Compliance

  • Law no. 09-08 on personal data protection: formalities in progress with the CNDP, detailed in the privacy policy.
  • Electronic invoicing: invoices produced and transmitted within the framework set by the DGI.
  • Hosting: provider established in the European Union, subject to the GDPR, ISO/IEC 27001:2022 certified.