Trust & Security
How ninezero protects your data — hosting, encryption, access control, and the vendors we work with. Straightforward answers for your procurement or security review.
Infrastructure & hosting
ninezero is developed and operated from Aarhus, Denmark. The application runs on dedicated infrastructure hosted within the EU, with application, database and analytics services isolated on a private network.
Data protection
Organization-level isolation
Every request is scoped to your organization at the database layer. Internally reviewed for cross-tenant access issues in September 2026.
Encryption in transit
All traffic between your browser and ninezero is encrypted with TLS (HTTPS), with certificates renewed automatically. Traffic between our own application and database services stays on an isolated private network rather than the public internet.
Encrypted credentials
Vendor credentials you connect (e.g. utility adapter API keys and passwords) are encrypted at the application layer with AES-256-GCM, a random initialization vector per record, and integrity verification on every read.
Your data, exportable
Full data export in standard formats at any time — no proprietary lock-in, no exit fees.
Data Processing Agreement
A DPA covering our processing of your data is available on request — email us and we'll send it over.
Access & authentication
Session security
Sessions use secure, httpOnly cookies that are never exposed to client-side scripts.
Phishing-resistant MFA
Passkey (WebAuthn/FIDO2) login is supported alongside magic links, including hardware security keys.
Scoped API access
Programmatic access uses prefixed, hashed API tokens you can revoke independently of your login credentials.
Activity logging
Key account and organization actions — sign-ins, permission changes, adapter configuration — are logged with who, what and when.
Subprocessors
Categories of third parties that may process data on our behalf, and when:
- Infrastructure hosting — EU-based cloud hosting for the application and databases
- Email delivery — account and notification emails
- Map rendering — only if you use the portfolio map
- AI processing — only for organizations with AI features enabled (off by default)
Questions, or need something specific?
Security questions, a DPA, or a security questionnaire for procurement — email us directly at christian [at] ninezero [dot] ai