Security

Reporting a vulnerability

Write to security@notifhq.com. Tell us what you found and how to reproduce it. We will acknowledge within two working days.

We will not pursue a researcher who reports in good faith, who does not access or destroy data beyond what a proof needs, and who gives us a reasonable opportunity to fix the issue before disclosing it.

Isolation between workspaces

Every row that can belong to a tenant carries its workspace, and every query that reads one is scoped by it. This is not left to reviewer discipline: a build gate asserts the scoping on each such table, so a query written without it does not reach production.

A credential issued to a widget or an end user is narrower still, and is bound to the single recipient it was issued for.

Credentials

API keys are stored as hashes; the plaintext is shown once, at creation, and is not recoverable afterwards. Revocation is immediate and is recorded.

Credentials for third-party providers are held as Worker secrets, never in the repository. A build gate refuses a commit that contains one.

In transit and at rest

All traffic is TLS 1.2 or better, with HSTS on every response. Data at rest is encrypted by the underlying Cloudflare storage.

Webhook payloads we send are signed, and the signature covers a timestamp so a captured payload cannot be replayed.

What we record

Every state change that matters is written to an append-only audit record naming the actor, the workspace, the time and the outcome. Records of that kind are never updated in place — a record that can be edited proves nothing.

Message contents are held for the raw-payload window of your plan and then deleted; the metadata about the delivery outlives the payload, which is the ordinary trade between being able to answer "did it arrive" and not keeping the message itself.

Incidents

If a breach affects customer data we notify the affected customers without undue delay, with what we know at the time rather than waiting for a complete picture, and we follow up as the picture fills in.