Access and encryption
Users only see the information intended for their role. Data is stored and transmitted in encrypted form.
Certification
ISO 27001: information security from day one
At Noventra, security is not an afterthought but a building block.
Stage 1 audit · December 2026
Orders
Rates
Addresses
Trip data
Emissions
Customer data
Measures
- Access control
- Data encryption
- Logging & monitoring
- Back-ups & recovery
- Supplier management
- Risk analysis
As a supply chain orchestrator, Noventra works with sensitive information: transport orders, customer data, rates, addresses, trip data and emissions figures.
That information comes from shippers, carriers and their customers, and all of it runs through OrangeChain. Anyone in that role must be able to demonstrate that they handle data with care. That is why we started on the path towards ISO 27001 certification right at the launch of our company.
01 The standard
What is ISO 27001?
ISO 27001 is the international standard for information security. The standard describes how an organisation sets up, maintains and continually improves an information security management system (ISMS). This is not only about technology, but also about processes, responsibilities and awareness within the organisation.
An ISO 27001 certificate is issued by an independent certification body after a two-stage audit. Annual surveillance audits follow. That way, security does not remain a one-off snapshot.
- 01International standardFor information security, with an ISMS as its foundation
- 02Two audit stagesBy an independent certification body
- 03Assessed every yearSurveillance audits, not a one-off snapshot
02 Our path
Where do we stand now?
Since its founding, Noventra has built ISO 27001 into how the organisation is set up and how OrangeChain is developed.
-
Since our founding
ISMS set up
Our information security management system has been set up, with designated owners for information security and privacy.
-
December 2026
Stage 1 audit Next step
Certification body Normec assesses whether our ISMS has been properly set up and documented, and whether we are ready for the next step.
-
After that
Stage 2 audit
The auditor assesses whether the measures work in practice as described.
-
Upon approval
Certification
The ISO 27001 certificate is issued.
-
Every year
Surveillance audit and pentest
Annual surveillance audits and a penetration test on OrangeChain keep security up to date.
03 Security by design
Why from the start?
Many organisations only start on ISO 27001 when a major customer asks for it. We deliberately chose the opposite route.
Common practice
Security as an afterthought
- Only starting when a major customer asks for it
- Retrofitting security into existing systems and habits
- Security that is built around things later
Noventra
Security by design
- OrangeChain is newly built, with security in the design from the first line of code
- More effective and more reliable than security that is built around things later
- ISO 27001 built in from our founding
04 In practice
What does this mean for our platform and our services?
Annual penetration test
Every year we have OrangeChain tested for vulnerabilities by means of a pentest. Any risks found are analysed and resolved.
Agreements across the whole chain
Information security does not stop at our own organisation. Our agreements with carriers also include requirements on data protection and cyber security.
Prepared for incidents
There are set procedures for reporting and handling security incidents, in line with the notification obligations under the GDPR. If a system goes down, there is a manual fallback procedure so that your transport keeps running.
05 Trust
How it supports our model
Noventra’s model revolves around trust. Shippers share their transport flows and volumes with us, and carriers share their rates and trip data. All of that information comes together in one platform.
That only works if every party can rely on its data being secure and only being used for what it is intended for.
ISO 27001 makes that trust demonstrable. It also strengthens our other services:
- Reliable data for your CSRD reporting Data that has been processed securely and in a controlled way is easier to account for to your auditor.
- Responsible AI Our AI agents work within the same secure environment, with every action logged.
- Doing business faster More and more organisations ask for demonstrable information security when selecting a logistics partner.
-
06 For you
What does this mean for you?
- Assurance that your logistics data is carefully protected
- Security built in, not added afterwards
- Independent assessment by an accredited certification body
- Continuous improvement through annual audits and pentests
- A partner that meets your own supplier security requirements
Contact
Questions about information security?
Would you like to know more about how Noventra handles your data, or do you have specific requirements from your own security policy? We would be happy to discuss them with you.
