Kept in Sydney
The database, files and app run in Sydney, Australia, the closest data centres to New Zealand.
Encrypted connections
Every connection to Nozl is encrypted, and the keys to your Xero and other services are encrypted too.
Your business only
The database checks every read and change, so no business can see another's, and franchise branches are walled off.
Roles and permissions
You choose what each person can do and see, and changes to quotes, invoices, payments and access are recorded.
Card details never touch Nozl
Card payments are taken by Stripe; card numbers go straight to them and are never stored in Nozl.
Backed up daily
The database is backed up every day, and photos and documents are private, shown only through links that expire.
Kept in New Zealand's backyard
Nozl's database, files and app run in Sydney, Australia, on Supabase and Vercel, the closest data centres to New Zealand. Every connection to Nozl is encrypted (HTTPS), and browsers are told to only ever connect securely.
Each business's information is its own
Every record in Nozl belongs to one business, and the database itself checks every read and every change against who's signed in. One business can never see another's. Within a business, a franchise branch is walled off from the other branches, and head office opening a franchise's customers is recorded where the franchise can see it.
People see what their role allows
You decide what each person can do: owners, branch managers, office staff and crews each have their own permissions, which you can change person by person. Crews see the jobs they're on; office staff see what their role allows. Changes to quotes, invoices, payments and people's access are recorded, with who made them.
Signing in
- Passwords are never stored as typed: they're kept scrambled (hashed) by Supabase's sign-in service.
- Emailed sign-in links work once and run out quickly.
- Your customers sign in to your customer portal with their own emailed link, separate from staff logins, and their session ends after a set time.
- Public pages, like a quote or invoice link, use long random links and are limited if someone tries too often.
Payments
Card payments are taken by Stripe, one of the world's largest payment companies. Card numbers go straight to Stripe and never pass through or get stored in Nozl. Messages from Stripe and Xero are checked to be genuinely from them before Nozl acts on them.
Files and connections
- Photos, PDFs, signatures and staff documents are stored privately, and shown only through links that expire within minutes.
- The keys Nozl uses to reach your Xero, ClickSend or PayHero are encrypted (AES-256), and nobody, including your own staff, can read them back.
Backups and our team
The database is backed up every day. Nozl's own team sees your support tickets and chats so we can help, and opening one is recorded in your business's own record of changes.
Found a problem?
If you think you've found a security problem in Nozl, please email hello@nozl.co.nz and we'll look at it straight away. How we handle personal information is in our privacy policy.