Data protection

Suriname does not yet have a data protection law, so we follow the EU GDPR as our standard. We collect only what our contact form and server logs need. We do not sell data, and we do not use it for advertising or profiling. The full details are in our Privacy Policy.

Subprocessors & hosting

These providers process data on our behalf to run this website:

These providers are based in the United States. For such transfers they offer safeguards such as the EU-US Data Privacy Framework or standard contractual clauses.

• Linode (United States, Miami): hosts this website.
• Resend (United States): sends contact-form messages to us by email.
• Google, Gmail (United States): the inbox where we receive and answer messages.

AI use & data handling

We use AI tools in our work: OpenAI through its API, and Anthropic's Claude for coding. When a project involves client data, we share only the parts needed for the task. We have switched off model training on our Claude subscription, and OpenAI does not use API data for training by default. A person reviews AI output before it reaches a client.

Security practices

No system is perfectly secure. These are the measures we have in place today:

To report a security concern, email info@nalviq.com.

• This website is served over HTTPS with a valid certificate.
• The server has a firewall and receives automatic security updates.
• Secrets such as API keys are kept in environment variables, never in our code repository.
• We use two-factor authentication on our key accounts: code hosting, server hosting, email sending and mail.
• We keep backups.