SECURITY

Security at NotifyHero

Your incident data is sensitive. We treat it that way — with enterprise-grade encryption, strict access controls, and a security-first architecture.

AES-256TLS 1.3SOC 2GDPRRBACMFASSO

Infrastructure

✓Hosted on AWS with isolated VPCs per environment
✓Multi-AZ deployments for high availability
✓Automated backups with point-in-time recovery
✓DDoS protection via AWS Shield

Data Encryption

✓AES-256 encryption at rest for all stored data
✓TLS 1.3 for all data in transit
✓Encryption keys managed through AWS KMS
✓Database connections encrypted end-to-end

Authentication & Identity

✓Single Sign-On (SSO) via SAML 2.0 and OIDC
✓Multi-factor authentication (MFA) for all accounts
✓API keys with granular scoping and expiration
✓Session management with automatic timeout

Access Controls

✓Role-based access control (RBAC) with least-privilege defaults
✓Comprehensive audit logging for all actions
✓IP allowlisting for API and dashboard access
✓Team-scoped data isolation

Compliance

✓SOC 2 Type II certification in progress
✓GDPR-compliant data handling and retention
✓Third-party penetration testing (planned)
✓Vendor security assessments for all sub-processors

Enterprise SLA

99.99% uptime SLA for Enterprise plans, backed by service credits. We publish real-time status at our status page.

Vulnerability Disclosure

Found a security issue? Report it to security@notifyhero.com. We acknowledge reports within 24 hours and aim to resolve critical issues within 72 hours.