We understand that your NocoBase instance contains business-critical data — customer records, workflows, internal processes. This document explains exactly how the Page Converter handles your data, what we store, what we don't, and what options you have if your security requirements go beyond our standard offering.
1. Your Data Never Leaves the Conversion Session
The core principle: Your NocoBase data exists on our server only during the active conversion — never before, never after.
Here's what happens during a conversion:
| Phase | What happens | Data on our server |
|---|---|---|
| Connect | You provide your NocoBase API URL and token | Stored in a server-side PHP session (encrypted, 24h timeout) |
| Analyze | We read your page list via the NocoBase API | Page names and structure held in memory only |
| Convert | The engine reads the v1 page schema and creates v2 models | Schema data processed in memory, written back to your instance via API |
| Verify | We read back the created v2 models and compare | Verification data in memory only |
| Done | Session data destroyed on logout or after 24h timeout | Nothing remains |
What we store permanently
- Conversion statistics: Anonymized metrics only — model count, duration, success/fail status, verification score. No page names, no schema data, no field definitions, no business data.
- License key and activation records — for billing purposes.
- Feedback — only if you explicitly submit it.
- Page structure for analysis — only if you explicitly consent (see below).
What we do NOT store — ever
- ❌ Your NocoBase schemas or page definitions (temporary files are automatically deleted after conversion)
- ❌ Your collection data (records, rows, documents)
- ❌ Your field configurations or business rules
- ❌ Your API token on disk (session-only, destroyed on logout or after 24h)
- ❌ Your workflow definitions
- ❌ Your NocoBase URL on disk (session-only)
- ❌ Any data from your NocoBase collections
Optional: Sharing page structure for analysis
If you encounter a conversion error, or if you opt in before conversion, you can choose to share an anonymized copy of the page structure with us. This helps us improve the conversion engine. Shared data:
- Contains only layout metadata (block types, field types, nesting structure)
- Does not include your business data, record contents, or API credentials
- Is deleted after analysis is complete
- Can be requested for deletion at any time
2. Server-to-Server Only — No Client-Side Exposure
The conversion is performed entirely server-to-server:
Your browser → Our server (PHP) → Your NocoBase API
↕
All processing here
(server-side only)
- Your API token is never sent to or stored in the browser.
- Your API token is never written to log files.
- All communication with your NocoBase instance uses HTTPS.
- Our server is hosted in the EU (Hetzner, Germany) with SSH-key-only access.
3. Non-Disclosure Agreement (NDA)
If your organization requires a formal Non-Disclosure Agreement before using external services, we are happy to accommodate.
We offer:
- Standard NDA — Our template covering mutual confidentiality obligations, available for electronic signature.
- Custom NDA — If you have your own NDA template, we will review and sign it.
- Electronic signing — We use electronic signature services for fast, legally binding execution.
📩 To request an NDA: Contact us at nocobasetools@inducera.eu with the subject "NDA Request". We typically respond within 1–2 business days.
4. Can't Connect to External Services? We Come to You.
We understand that some organizations have strict security policies that prevent connecting internal systems to external services — even temporarily. We have a solution for you.
On-Site / Private Consulting
We offer consulting engagements where we perform the migration within your infrastructure:
- 🔒 Your network, your rules — We work inside your environment, on your hardware or VPN.
- 🛠️ Same engine, private deployment — The same conversion engine, deployed privately for your use.
- 📋 Custom scope — We can handle the full migration, or train your team to run it independently.
- 💰 Quote-based pricing — Based on the number of pages, complexity, and engagement model.
📩 To discuss consulting: Contact us at info@inducera.eu and describe your situation. We'll provide a tailored proposal.
5. NocoBase Plugin — Coming Based on Demand
We are planning to offer the Page Converter as a NocoBase plugin that installs directly in your instance. This means:
- ✅ No external connections needed — everything runs inside your NocoBase
- ✅ No data leaves your server — all processing is local
- ✅ No API token sharing — the plugin operates with internal access
- ✅ Self-service migration at your own pace
This is on our roadmap, prioritized by demand. If a native plugin would solve your security concerns, please let us know — your interest directly drives our development priorities.
📩 Register interest: nocobasetools@inducera.eu with subject "Plugin Version — Security Priority"
6. Summary: Your Options
| Your situation | Our solution |
|---|---|
| Standard use — comfortable connecting via API | ✅ Use the converter directly at nbtools.inducera.eu |
| Need formal confidentiality agreement first | 📝 We sign an NDA (ours or yours) — request here |
| Cannot connect to external services at all | 🤝 On-site consulting — we come to you — get a quote |
| Want everything to stay on your server | 🔌 Plugin version (coming) — register interest |
7. Technical Security Measures
| Measure | Status |
|---|---|
| HTTPS everywhere (TLS 1.2+) | ✅ Active |
| Server-side session storage only | ✅ Active |
| No client-side token storage | ✅ Active |
| Automatic temp file cleanup (on success and failure) | ✅ Active |
| No API token written to disk | ✅ Active |
| No tracking cookies or analytics | ✅ Active |
| EU hosting (Hetzner, Germany) | ✅ Active |
| SSH-key-only server access | ✅ Active |
| Session auto-expiry (24h) | ✅ Active |
| No third-party data sharing | ✅ Active |
| GDPR compliant | ✅ Active |
8. Contact
Questions about data security, NDA requests, or consulting inquiries:
- Email: nocobasetools@inducera.eu
- Consulting: info@inducera.eu
- Website: inducera.eu
See also: Privacy Policy · Terms of Service