How we protect data and build software for buyers in insurance, healthcare, and financial services. We publish only what we actually do; where a control is still being formalized, we say so.
All traffic to nolte.io is encrypted in transit over TLS. Our marketing site is a static site: it has no application database and stores no client or end-user records. We do not store payment information or sensitive credentials on our servers.
The only personal data we collect is what you submit through a form (name, email, company) or, on the readiness tool, the answers you explicitly choose to email yourself. That data is processed only by the subprocessors listed below, each of which encrypts data at rest under its own attested controls. We do not hold a standing copy of it in our own infrastructure.
Our delivery engine, NolteOS, is built on a control that regulated buyers care about: AI accelerates the work, but a senior human approves every change, and every decision is recorded. Nothing reaches a client's production environment on an AI's say-so alone.
NolteOS is the platform our team uses to plan capacity, track deliveries, and give clients visibility into their own work. The questions regulated buyers ask about it:
We operate on least privilege: access to systems and client environments is granted by role and only to the people who need it. Multi-factor authentication is enforced on company accounts, single sign-on is used where a platform supports it, and access is removed as part of offboarding when someone leaves or an engagement ends.
We build on established providers that carry their own independent SOC 2 and/or ISO 27001 attestations, rather than operating our own data centers:
A full subprocessor list, with the purpose, data categories, and region for each, is maintained on our DPA and subprocessors page.
We have a process for triaging and responding to security incidents, and we commit to notifying affected clients without undue delay once an incident affecting their data is confirmed. Because our site holds no standing client-data store, our recovery posture depends primarily on our providers, who maintain their own backups and redundancy. We are formalizing our written incident-response and business-continuity documentation; that work is in progress and will be reflected here as it is completed.
If you have found a security issue, we want to hear about it. See our responsible disclosure policy for scope, safe-harbor terms, and how to report. You can also reach us directly at security@nolte.io.
Nolte does not currently hold a SOC 2 or ISO 27001 certification. We build on infrastructure that does, and we operate the controls described on this page. We would rather state that plainly than imply a certification we do not have. See our Trust Center for the current picture.
Security questions, disclosures, and diligence requests: security@nolte.io.
The accountable owner for security at Nolte is Jeffrey Nolte, Founder.
Last reviewed: October 13, 2026.