Security and privacy
What we do to keep your organisation's data safe. Each point describes how the product works today.
Each organisation is kept apart
Every table that holds an organisation's data has row level security in the database. A request can only read the rows of the organisation it works for, and a request without that context gets nothing.
People see only what their role allows
Every action on the server checks the person's role at that part of the structure. There is no hidden admin path in the app.
Sign in and sessions
Passwords are stored only as strong hashes. Sessions use secure cookies. People can see their signed in devices and sign out of any of them. Our platform team must use two step verification.
Anonymous means anonymous
For an anonymous grievance, the filer's identity is stored encrypted in a separate table that handlers cannot read. No screen or answer gives handlers the filer's name or id.
Strict rules for AI
Your content goes to the AI model as data, never as instructions. Confidential grievances never go to the model. AI answers are checked against a fixed format and never act until a person clicks.
Every staff action is recorded
Changes by staff go into the organisation's audit log. If our team ever acts inside your organisation, the log shows both names.
Safe in transit
Every page and every API call uses HTTPS. Our sites send strict security headers, including a content security policy.
People control their own data
Anyone can download their data and delete their account from their profile. Deleting removes personal details and keeps only anonymous counts for the organisation's statistics.
Questions about security? Write to support@notifyi.app.
Tell us about your organisation
We will set up Notifyi with a structure that fits you and show you how it works.