Keeping your information safe.

Reporting a security problem

If you think you've found a vulnerability in this website or in NOVA, please email [email protected] with "Security" in the subject line. Include the address of the page, what you did, what happened, and any steps or screenshots that help us reproduce it.

We'll confirm we received your report within 5 business days and keep you updated while we investigate and fix it. Please give us a reasonable chance to fix the problem before telling anyone else about it.

Good-faith research

We won't take legal action against anyone who reports a problem in good faith and follows these rules:

• Only test against your own account, and don't access, change or delete other people's information.
• Don't run tests that could slow down or interrupt the site, and don't send spam or automated form submissions.
• No social engineering, phishing or physical attacks against our staff or offices.
• Stop and tell us as soon as you come across personal information.

How we protect your information

• Sign-in: two-step sign-in, passwords checked against known data breaches, and automatic lockout after repeated failed attempts.
• Sessions: signed out after 12 hours of inactivity; every signed-in device can be reviewed and signed out.
• Encryption: HTTPS on every page, and stored data encrypted at rest.
• Privacy-first analytics: no tracking cookies and no stored IP addresses; other analytics only load after you agree.
• Data in Canada: our content, form submissions and files are stored in Toronto.
• Backups: encrypted copies made every night and kept off the web server.

Privacy officer

Michael, Owner, is responsible for the protection of personal information at Envy Design Co. Reach him at [email protected].

Questions about how we handle personal information are covered in our privacy policy.