Trust
Security and trust
Technical controls, independent tests and clear company details. This page describes how NovaMX runs, not a compliance certificate.
Due diligence
Documents and public checks
Start here when you evaluate NovaMX as a Dutch contract party. These pages are public before checkout.
Cyberbeveiligingswet
Essential entity registration
NovaMX B.V. is registered as an essential entity under the Dutch Cyberbeveiligingswet (the Dutch NIS2 implementation). NCSC registration ID 5bbf74f7 (22 August 2026). Supervisor: RDI. CSIRT: NCSC. This is a factual registration, not an ISO certificate and not a claim of NIS2 certification.
Your data and domains
Staying is the goal; leaving stays simple
We build NovaMX so you can run domains, DNS, mail and hosting in one account for the long term. If you ever choose another provider, we make that path straightforward: no artificial lock-in.
- Domains: standard registrar transfer with an authorisation code
- DNS: portable zone export when NovaMX hosts your DNS
- Websites: backup download and restore according to your package
- Mailboxes: export via IMAP or webmail; support can help with larger moves
- On contract end: return or deletion of processor data under the DPA
Continuity
Backups and restore practice
Platform, hosting and mail backups run on a daily schedule where the service includes them. Copies are encrypted and stored off-site from the production hosts. Our recovery-point objective is on the order of 24 hours. We do not publish a public uptime percentage; we focus on restoreability and clear status updates.
- Encrypted off-site backup copies for portal data, web roots and mail archives
- Periodic restore tests with evidence kept in our compliance records
- Last documented portal database restore drill: August 2026
- Customer website dual-origin serving and secondary mail MX where those designs are live
Account access
MFA and account recovery
Portal operators use role-based access with multi-factor authentication (MFA). Keep backup codes or a registered device safe. If you lose access, contact your organisation’s customer admin first; NovaMX support can help after an identity check. See Help for portal roles and MFA.
Company
Who you are dealing with
NovaMX B.V. is a Dutch company. You can verify our registration details below and reach us through the published contact channels.
- NovaMX B.V., Salland 1, 1948 RE Beverwijk, The Netherlands
- KvK 42107118 · VAT NL869765097B01
- Phone +31 85 130 0982 · contact@novamx.eu
- IBAN NL79 MLLE 0089 8955 25 · BIC MLLENL2A
Independent tests
Public scores for novamx.eu
These reports are for our own website and mail infrastructure. In My NovaMX we also run checks on your domains so you can see website and mail security status.
Customer reviews
What customers say
Independent customer reviews for NovaMX are published on an external review site. We invite reviews after a completed order. We do not embed review widgets on this site.
Controls
Security baseline
NovaMX uses HTTPS, HSTS, DNSSEC, DANE where applicable, restrictive security headers, monitored infrastructure events, role-based admin access and tracked operational incidents. This page describes technical controls; it is not a legal NIS2 or GDPR compliance certificate.
| Area | What NovaMX does |
|---|---|
| Transport | HTTPS with HSTS on public sites; HTTP redirects to HTTPS |
| DNS | DNSSEC for NovaMX zones; customer DNSSEC when NovaMX DNS is active |
| Browser security | Strict CSP and security headers on portal and marketing hosts |
| Admin access | Role-based admin access with MFA for portal operators |
| Infrastructure | European suppliers for hosting, mail and platform services |
Payments
Checkout and payment methods
Browse packages, add them to your cart, and complete checkout in My NovaMX. Payments are processed through our EU payment provider.
- Catalog prices and the cart are available on this site and in My NovaMX
- Checkout and payment run in My NovaMX after you sign in
- Orders and payments go through My NovaMX once you create an account
Monitoring and incident handling
Infrastructure sources send signed events to NovaMX monitoring. Critical findings can create admin incidents and are reviewed by NovaMX operations. Automated remediation is only triggered by an operator where the action is safe and authorized.
Privacy requests
Customers can request data access, correction, export or deletion review through the customer portal. Deletion is reviewed manually because legal retention, billing records and service obligations may apply.
Domain registration data
How we verify and share domain holder data
As a domain registrar NovaMX publishes two procedures required under the Dutch Cyberbeveiligingswet: how we check that registration contacts are accurate, and how we handle lawful requests for specific holder data. These are not a bank-style identity programme.
Abuse handling
Clean Networks
NovaMX B.V. has signed the Dutch sectoral code of conduct on abuse handling (Gedragscode Abusebestrijding). That is a public commitment to take reports seriously.
Responsible disclosure
Security researchers can contact NovaMX through the published security.txt information. Please do not access, change or exfiltrate customer data while reporting a vulnerability.
FAQ
Trust questions
Is NovaMX ISO-certified?
We do not claim ISO or similar certifications on this page. We publish technical controls and independent test reports instead of badges we have not earned.
Is NovaMX registered under the Dutch Cyberbeveiligingswet?
Yes. NovaMX B.V. is registered as an essential entity under the Cyberbeveiligingswet. That registration is not an ISO or NIS2 compliance certificate.
Where can I see outages?
status.novamx.eu shows public component status, maintenance windows and incidents that affect customer services.
Can I leave NovaMX later?
We build NovaMX to keep you. If you ever move, domain transfer, DNS zone export, website backups and mailbox export are designed to make that straightforward.
How do I report a security issue?
Use the contact details in security.txt. Do not probe customer data or disrupt production while reporting.