Product Security
Updated Jul 13, 2026How the Notch platform itself is built, secured, and operated — from the software development lifecycle through the AI agents customers deploy in production.
Secure Development
- Secure Software Development Lifecycle establishedSecurity requirements, reviews, and testing are embedded across the development process, supported by SDLC training for engineers.
- Change Management procedures enforcedProduction changes follow defined review and approval workflows.
- Vulnerability scanning procedures establishedOngoing scanning across the application and its dependencies.
- Penetration Testing conductedAnnual third-party penetration tests, complemented by internal testing; a summary is available on request.
- Responsible disclosure program operatedVulnerability reports are accepted at security@notch.cx.
Product Authentication & Access
- Authentication and authorization by a dedicated identity provider (Descope)Customers define their own level of access: SSO, MFA, and PassKeys.
- Enterprise IAM and SSO integration supportedNotch integrates with customers' existing identity infrastructure.
- Role Based Access Control (RBAC) enforced in-productLeast-privilege design governs what users and agents can access.
- Secure API access with authenticationAll API integrations are authenticated, including customer OAuth flows.
AI Security & Guardrails
- Deterministic, policy-bound guardrails enforcedGuardrails control when and how AI engages, with escalation paths and approval workflows reflecting the customer's governance model.
- AI decisions logged with reasoning and source referencesFull audit trail for QA, compliance review, and regulators.
- No customer data used for model trainingNeither Notch nor its LLM API vendors train models on customer data.
- LLM providers accessed via enterprise accounts with zero data retentionAI vendors are selected specifically for their security and privacy posture.
- Guardrails battle-tested through internal and external penetration tests
Tenant Isolation & Data Protection
- Strong separation between tenant data enforcedMultitenant deployments run on separate servers, with an optional fully separate environment and infrastructure.
- EU data residency options offered
- Encryption in transit and at rest implementedTLS 1.2+ in transit, AES-256 at rest, with a formal key management process and point-in-time backups.
- Configurable retention and secure deletion supportedRetention periods are defined by the customer in the DPA.
- Automatic or API-based data redaction available
Infrastructure & Deployment Security
- Production environment segregation enforcedCloud servers run in a private VPC with restricted network and firewall access.
- WAF and DDoS protection deployed (Cloudflare)Complemented by IP access restrictions and strong authentication.
- Intrusion Detection systems utilizedAlongside continuous production monitoring.
- Redundancy and disaster recovery built inDatabase replicas, server autoscaling, multi-availability-zone deployment, and vendors with multi-zone fallback.
- BYOC deployment option availableCompute, storage, and integrations can be deployed within the customer's own cloud environment.
Auditability
- End-to-end audit logs establishedFull traceability of all data processing and of access and operations on production systems.
- Production data access restrictedStrictly as-needed, identity-based approval.
- Compliance reporting capabilities provided