Tenants are separated by the database
Row-level security is forced on every tenant table. Your organization is taken from your verified sign-in, never from a web address or a request body, so one customer cannot ask for another's data.
Built for a security review
Notify was designed for senders who are audited. These are the controls, where they are enforced, and what we have not done yet.
Where each control lives
Our operators cannot read your customers
The platform's own administration runs on a database role with no access to contacts, messages, templates or campaigns. It sees counts, never content.
Maker-checker is a database rule
A campaign cannot be approved by the person who created it. The constraint is in the schema, below the application, where a bug cannot remove it.
Consent has a date and a source
Marketing consent cannot be stored without when and how it was given. It is evaluated again at the moment each message is sent.
Every organization is verified first
Business verification with a human review comes before the first message. Suspending an account takes two operators.
Access is narrow by default
Two-factor authentication, session expiry, lockout after failed sign-ins, API keys with scopes and IP allowlists, and roles that cannot exceed their author.
Sending that protects your name
Mail leaves from your own verified domain, signed with your own DKIM key. Every marketing message carries a one-click unsubscribe and your postal address.
Bounces and complaints suppress the address automatically. If your rates cross a threshold, marketing pauses and you are told, instead of a provider quietly throttling you.
Where we are today
Notify does not yet hold an ISO 27001 or SOC 2 certificate, and has not yet had an independent penetration test. Both are planned.
Until then we will walk your security team through the threat model, the tenant isolation tests that run on every change, and the database grants themselves.
Talk to usOpen an account today. Send when your business is verified.
Registration takes a few minutes. We verify every organization before its first message, which is what keeps the sending reputation clean for everyone.