Notice Labs Trust & Security
Last reviewed: September 29, 2026
Featured Documents
- Privacy Policy
- Data Processing Agreement
Security Controls
Subprocessors
+14 subprocessors
Compliance
GDPRAlignedData & Privacy
Request a copy of your personal data, update details, or manage deletions.
Report a Vulnerability
For security issues that may affect customers or our platform, send the details to our security team.
Documents
Documents marked "Request access" require a quick request so we know who's reviewing them. Everything else is public.
Privacy Policy
Our commitment to your privacy: how we collect, process, and secure your personal data.
Updated Sep 2026VisitData Processing Agreement
Review our standard data protection terms and security commitments. Full copies are available upon request and automatically approved for active customers.
Updated Sep 2026
Security
How Notice Labs protects customer data, grouped by the questions a security review asks.
Access
Who can get to your data?
- Multi-factor authenticationStaff need more than a password to sign in to systems that hold customer data.
- Least-privilege accessStaff, contractors and vendors get only the access their role needs.
- Secrets managementCredentials and keys are kept out of source code, in secret storage with restricted access.
Data
Is your data protected, kept apart, and removed when you leave?
Foundations
Is the service built on solid ground, and will it stay up?
- Audited cloud hostingProduction runs on cloud providers that hold independent security audits.
- Email domain protectionMail from the company's domain is authenticated, so others can't send it in its name.
- Network protectionTraffic to production is filtered to block unauthorised access and denial-of-service attacks.
Product security
Is the product built and changed safely?
- Vulnerability disclosureAnyone can report a vulnerability through a published channel. Report to: https://trust.noticelabs.co
- Automated security checksCode and dependencies are scanned automatically for known security problems before release.
People and suppliers
Are the people, devices and vendors that could touch your data vetted?
- Security trainingStaff are trained in security, including phishing and data handling, and refreshed regularly.
- Background checksStaff are background-checked, where the law allows, before they can reach customer data.
- Device securityCompany devices that reach customer data are encrypted, managed and protected from malware.
AI
If AI is used, is it governed, and is your data kept out of training?
- No training on customer dataCustomer data isn't used to train AI models without the customer's consent.
- AI use policyStaff and product use of AI follows a written policy on approved tools and data handling.
- Human oversight of AIA person reviews AI output before it drives a decision that affects a customer.
Notice Labs Controls. Notice Labs states these apply; they aren't verified by Notice Labs.
Subprocessors
Third parties that process customer data on Notice Labs's behalf. Region refers to where data is processed.
Cloudflare
GlobalCloud hosting and infrastructure
Supabase
GlobalCloud provider
Resend
GlobalEmail delivery and transactional messaging
Polar
GlobalPayment processing and merchant of record
