Security
Last updated: January 20, 2026
At InstaNotified, security is foundational to everything we do. We understand that you trust us with your critical operational data, and we take that responsibility seriously. This page outlines the measures we take to protect your data and ensure platform reliability.
Data Encryption
All data is encrypted in transit using TLS 1.2+ and at rest using AES-256 encryption.
High Availability
99.9% uptime SLA with database replication and globally distributed infrastructure.
Role-Based Access
Row-Level Security policies ensure users can only access data they're authorized to see.
SOC 2 Roadmap
Actively working toward SOC 2 Type II certification with enterprise-grade controls.
Infrastructure Security
Our platform is built on enterprise-grade cloud infrastructure:
- Database: Supabase (built on AWS) with automatic failover and replication
- Web Hosting: Vercel's global edge network with automatic DDoS protection
- Communications: Twilio's enterprise-grade SMS/Voice infrastructure
- Payments: Stripe's PCI-DSS Level 1 certified payment processing
- AI Services: OpenAI's SOC 2 certified API infrastructure
- Push Notifications: Expo's notification service via APNs and FCM
Data Protection
Automated Backups
Daily automated backups with 30-day retention. Point-in-time recovery available for database restoration within seconds.
Data Isolation
Multi-tenant architecture with Row-Level Security (RLS). Each company's data is logically separated at the database level—no company can ever access another's data.
Secure Deletion
When you delete data or close your account, it is permanently removed from our active systems within 30 days and from backups within 90 days.
Encryption Standards
TLS 1.2+ for all data in transit. AES-256 encryption for data at rest. Passwords hashed using bcrypt with automatic salting.
Authentication & Access Control
- Secure Authentication: Email/password authentication with secure password hashing (bcrypt)
- Phone OTP: Employees can authenticate via SMS one-time passwords for passwordless login
- Multi-Factor Authentication (MFA): Available for admin accounts via authenticator apps (TOTP)
- Session Management: Secure JWT tokens with configurable expiration. Sessions can be revoked remotely.
- Role-Based Permissions: Granular access control with admin, branch manager, and employee roles
- API Security: All API endpoints protected with authentication. Rate limiting prevents abuse.
AI & Machine Learning Security
Our AI features are built with privacy and security in mind:
- Voice transcription data is processed in real-time and stored only as incident records
- Your data is not used to train public AI models (OpenAI's API does not train on customer data)
- AI prompts are designed to prevent data leakage between customers
- You can opt out of AI features at any time by contacting support
Mobile App Security
The InstaNotified Employee App includes additional security measures:
- Secure token storage using device keychain (iOS) and encrypted SharedPreferences (Android)
- Certificate pinning to prevent man-in-the-middle attacks
- Location permissions requested only when needed for clock-in verification
- All data transmitted over HTTPS only
- Session tokens expire after inactivity and can be revoked remotely
- No sensitive data stored in plain text on device
Security Testing & Monitoring
Continuous Monitoring
24/7 infrastructure monitoring with automated alerts. Real-time logging and anomaly detection.
Vulnerability Assessments
Regular automated security scans. Dependency vulnerability monitoring with automated updates.
Penetration Testing
Annual third-party penetration testing by qualified security firms. Critical findings addressed within 24 hours.
Incident Response
We have a documented incident response plan:
- Detection: Automated monitoring detects anomalies and potential security events
- Response: On-call security team responds to incidents within 1 hour
- Containment: Affected systems isolated to prevent spread
- Notification: Affected customers notified within 72 hours of confirmed breach (or sooner if required by law)
- Recovery: Systems restored from clean backups with enhanced monitoring
- Post-Incident: Root cause analysis and preventive measures implemented
Compliance & Certifications
SOC 2 Type II (In Progress)
We are actively working toward SOC 2 Type II certification, expected completion Q3 2026. Our security controls are designed to meet SOC 2 Trust Service Criteria.
GDPR Compliant
Our data handling practices comply with GDPR requirements including data subject rights, lawful processing, and international transfer protections.
CCPA/CPRA Compliant
We comply with California privacy laws including consumer rights and data protection requirements.
TCPA/CTIA Compliant
Our SMS/Voice features comply with telecommunications regulations including opt-in/opt-out and message content requirements.
Our Commitment
We are committed to continuously improving our security posture. Security is not a destination but an ongoing process. We regularly review and update our security practices, invest in security training for our team, and stay current with emerging threats and best practices.
Security for Enterprise
Enterprise customers have access to additional security features:
- Custom data retention policies
- SSO/SAML integration (coming soon)
- Dedicated security review and questionnaire completion
- Custom DPA (Data Processing Agreement)
- Security audit reports available upon request (under NDA)
Report a Vulnerability
If you believe you have discovered a security vulnerability, please report it responsibly. We appreciate the security research community's efforts to help keep our platform secure.
Email: security@instanotified.com
What to include:
- Detailed description of the vulnerability
- Steps to reproduce the issue
- Potential impact assessment
- Your contact information for follow-up
We will acknowledge your report within 48 hours and provide updates as we investigate. We do not pursue legal action against security researchers who act in good faith.