Security and compliance
Built to pass your security review.
Your IT and compliance teams will have questions. Here are the answers, and we're happy to go through your questionnaire with them.
Who can sign in
Your company sign-inEnterprise SSO with Okta, Microsoft Entra, or Google.
Automatic access changesSCIM adds people when they join and removes them when they leave.
Two-step sign-inRequired for everyone. Passkeys supported.
Access by brand and officeOffice managers see their office. Brand managers see their brand.
What happened and when
Audit logEvery edit, approval, and sign-in, with who did it and from where.
Approvals before publishingSet who has to sign off on what, by brand, site, or kind of content.
Undo anythingEvery change set can be rolled back, and every page keeps its history.
Noble staff accessOur support team can only view your workspace with permission, and you’re told when they do.
Where your data lives
Encrypted everywhereData is encrypted in transit and at rest.
Daily backupsBackups are kept in a separate region and tested regularly.
Dedicated hostingYour own servers and database, run by Noble.
Or your own cloudRun Noble on AWS, Azure, or Google Cloud under your own controls.
Healthcare
Patient privacy is enforced, not left to a setting.
When a site is marked as healthcare, Noble blocks the trackers that have gotten practices into trouble and keeps health details out of contact forms.
- Google and Meta tracking pixels can’t be added to healthcare sites.
- Forms remind visitors not to share health details, and flag messages that do.
- Form submissions are stored encrypted and kept only as long as you choose.
- A business associate agreement is available for healthcare customers.
For your review
We send these under NDA. Ask through the contact form or your Noble contact.
- Security overview
- Completed security questionnaire
- Data processing agreement
- Business associate agreement