Our commitment

The NOVA AVA Service Level Agreement guarantees 99.8% system availability 24/7, excluding maintenance windows, and establishes strict guidelines for data security and GDPR compliance. Support is provided exclusively through three tiers, including proactive monitoring, and is available on weekdays from 8:00 a.m. to 5:00 p.m. (4:00 p.m. on Fridays) CET. Incidents are prioritized by severity, while service and change requests are billed based on effort, and the latter do not necessarily require approval.

For its SaaS solution, NOVA AVA uses ISO 27001-certified AWS servers in Germany that are GDPR-compliant and encrypt data using AES-256 (at rest) and SSL (in transit). The application has been hardened in accordance with BSI penetration testing and the OWASP Top 10 and is additionally protected by AWS Shield and WAF. Regular updates and ClamAV are implemented. It offers configurable password policies, 2FA, SSO, and a comprehensive backup strategy. Interfaces such as REST API, GAEB, IFC, Excel, and CSV, as well as application-specific certificates, are available.

The Data Processing Agreement (DPA) between NOVA BUILDING IT GmbH and the customer governs the processing of personal data by NOVA on behalf of the customer in compliance with data protection regulations, based on Article 28(3) of the GDPR. It defines obligations, rights of oversight, the use of subcontractors, confidentiality, and technical and organizational measures for data security.

The final report on the penetration test for the NOVA AVA web application, conducted by Secuvera between January 7 and February 13, 2025, attests to the application’s “very high level of security,” as no vulnerabilities were ultimately identified. The test, a white-box test at the application level, was conducted in a lab environment on a virtual Kali Linux machine using tools such as “sqlmap” and “Burp Suite Pro.” The objectives were to identify technical vulnerabilities and to review the permissions and roles framework, based on the OWASP Testing Guide v4 and the BSI study “Implementation Concept for Penetration Tests.” All vulnerabilities and security issues identified during the tests were remedied by the client while the test was still in progress, and the remediation was verified.