What we touch, where it goes, and what we can prove.
Banks, insurers and pharmaceutical companies review their suppliers before a project starts. This page answers the first questions those reviews ask. Where we do not have something, we say so.
The short answers
| Legal entity | TATJANA KOJIĆ PR AGENCIJA ZA IT USLUGE NONI SOFT BEOGRAD, registration no. 65284103, tax ID 111248275, Belgrade, Serbia |
|---|---|
| Where we work from | Belgrade, Serbia, outside the EU, on Central European Time. Our longest-running engagement is for a company in Norway. |
| Personal data from the EU and EEA | Serbia is outside the EU and does not have an EU adequacy decision. If your personal data would leave the EU or EEA during a project, we sign the European Commission's standard contractual clauses with you before it does. Wherever we can, we work inside your systems, so your data stays where you keep it. |
| Where systems and data run | In your environment, not ours. We do not host client data on our own infrastructure. In our longest-running engagement, every system and all data stay on the company's own servers in Norway; we work through remote sessions on virtual machines inside that environment. |
| Contracts and invoicing | Contracts and invoices in EUR. |
| Who has access | Only the engineers assigned to your project. Accounts are created by you or your IT provider, at your request, and you can remove them at any time. We never create our own accounts on your systems. We give you the list of people on request. |
How we build
Two of our own systems show the practices we bring to every project. Both are described in detail, with the checks they run:
- A file vault where every request passes eight checks in a fixed order, refusals all look the same, passwords are hashed with argon2id, sessions are stored only as hashes, and passwords, cookies and request bodies never reach the logs. Read about the vault.
- Kvit, our records system, where issued invoices are locked by the database itself, archives carry checksums, sign-in needs a passkey or an authenticator code, and the server sends a strict content security policy. Read about Kvit.
These are our own builds. They show habits, not a guarantee.
Suppliers we use
- Cloudflare: hosting and delivery for this website and for Kvit. It also provides the visit statistics for this website (see privacy below).
- Resend (EU region): sends Kvit's reminder emails.
- Google Workspace (Gmail): our email.
- UiPath: the robotic process automation platform our robots are built on.
- nonisoft integrations: our own custom integration solutions, built and tailored for each project.
- Claude (Anthropic): an AI assistant used in our engineering work.
Privacy on this website
This site sets no cookies and has no forms. Contact is by email only.
We use Cloudflare Web Analytics to count page views and to measure how fast pages load for real visitors. It shows us which pages were viewed, which sites sent visitors, the visitor's country and loading times. Cloudflare states that Web Analytics uses no cookies or local storage, does not fingerprint visitors by IP address or browser details, and does not collect or use visitors' personal data (Cloudflare's documentation).
Cloudflare also hosts this site, so like any web host it receives the technical details every browser sends, such as the IP address, in order to deliver the pages.
Send us your questionnaire.
We answer supplier security and due-diligence questionnaires in full, and we tell you plainly where we do not meet a requirement.
Email office@noni-soft.com