Security Controls

Infrastructure security

These controls cover how the platform is hosted, how data is encrypted, and how traffic is protected at the network edge.

• Azure hosting with regional pinning

  The NotAI platform runs on Microsoft Azure. Customers choose a US or EU data region at signup; primary service data is stored and processed in that region and is not moved between regions. Limited ancillary data - billing and transactional-email metadata - is processed in the United States, as described in our privacy policy.

• Encryption at rest with customer-managed keys

  Stored data is encrypted at rest. Magic-link cryptographic material is protected with customer-managed keys held in Azure Key Vault.

• TLS-only transport

  Every connection to NotAI services requires TLS. Unencrypted transport is not accepted, and HSTS is enforced on our web properties.

• DDoS protection and WAF at the edge

  Traffic passes through Cloudflare's edge network, which provides DDoS mitigation and a web application firewall in front of the platform.

• Dual-CDN failover

  Cloudflare is the primary content delivery network, with Azure Front Door configured as a failover carrying matching rules, so delivery continues if the primary edge is unavailable.

• Separate production environment

  Production runs in its own environment, separated from integration and staging. Changes are promoted through the lower environments before they reach production.

Product security

These controls are built into the NotAI dashboard and APIs and govern authentication, authorization, and access to restricted material.

• Passwordless magic-link authentication

  Dashboard sign-in uses single-use magic links delivered by email. NotAI stores no passwords, which removes credential databases as an attack target.

• Role-based access control

  Dashboard permissions are assigned by role, so administrators can scope what each team member can view and change.

• Audit logging of administrative actions

  Administrative actions in the dashboard are logged so account activity can be reviewed after the fact.

• Accessibility conformance

  The platform is developed against WCAG 2.1 AA. Our accessibility conformance report (VPAT) is available through the resource library.

• Scoped API keys

  API access is authenticated with keys scoped to the capabilities an integration actually needs.

Data privacy

These controls limit what NotAI collects, fix where data lives, and support the rights of customers and data subjects.

• Zero tracking cookies

  The marketing site and this trust center set zero cookies and load zero third-party scripts. There is no client-side analytics anywhere on NotAI's public web properties.

• Regional data residency

  Primary service data is pinned to the US or EU region selected at signup and is not moved between regions; limited ancillary data (billing and transactional-email metadata) is processed in the United States, as described in the privacy policy.

• Data minimization

  NotAI analyzes behavioral signals such as typing cadence, pauses, and corrections. It does not perform content surveillance: there is no screen recording and no webcam access.

• Data subject request handling

  Access and deletion requests are supported, with the process described in the privacy policy.

• Retention limits

  Collected signals are retained only as long as needed for the purposes described in the privacy policy and the customer agreement.

• DPA with SCCs and IDTA

  A Data Processing Agreement incorporating the EU Standard Contractual Clauses and the UK International Data Transfer Addendum is published.

Development security

These controls govern how code moves from a developer's machine to production and the automated gates it must clear along the way.

• CodeQL static analysis

  Every change runs through CodeQL static analysis in continuous integration before it can merge.

• Dependency scanning

  Dependencies are scanned for known vulnerabilities as part of the same continuous integration pipeline.

• Pre-deploy secret scanning

  Build outputs are scanned for credentials and for analytics or tracking strings before deployment. A match fails the pipeline.

• Enforced quality gates

  Commits and pull requests must pass linting, unit tests, builds, and end-to-end checks. The gates are enforced by tooling, not left to convention.

• Reviewed dependency updates

  Dependency versions change only through reviewed updates, keeping every upgrade deliberate and auditable.

Organizational security

These are the people-and-process controls that govern how NotAI operates internally.

• Least-privilege production access

  Access to production systems is limited to the minimum set of people and permissions required to operate the platform.

• MFA on internal accounts

  Multi-factor authentication is required for administrative and privileged access to internal systems.

• Vendor and subprocessor review

  Vendors and subprocessors are reviewed for security posture before use. The current list is published on the subprocessors page.

• Incident response process

  A documented incident response process covers detection, escalation, and customer notification commitments. The incident response plan summary is available as a restricted document in the resources library.

• Background screening

  Personnel with production access undergo fingerprint-based criminal-history checks before access is granted, as warranted in our Data Processing Agreement.

• Role-based security responsibilities

  Security responsibilities are assigned by role, so each person's obligations are explicit.

Monitoring & availability

These controls cover how we watch platform health and security signals, and how we prepare for disruption.

• Uptime monitoring

  Platform availability is monitored continuously, and each deployment is verified with post-release checks before it is considered healthy.

• Edge analytics only

  Traffic visibility comes from CDN edge analytics. No tracking scripts run in visitors' browsers.

• Centralized security logging

  Security-relevant events are collected centrally so they can be reviewed and investigated.

• Business continuity and disaster recovery

  BC/DR planning, including recovery time and recovery point objectives, is covered by our SOC 2 Type II audit. The BC/DR summary is available as a restricted document in the resources library.

AI governance

NotAI is an AI vendor, so we hold our own detection systems to explicit transparency and governance commitments.

• EU AI Act transparency notice

  An Article 50 transparency notice describing how NotAI's detection systems work is published at isnotai.com/ai-transparency.

• Human-review-first detection

  NotAI surfaces evidence about how work was produced; institutions make the decisions. Detection results are designed to inform human review, never to automate outcomes.

• Model update discipline

  Detection models are revised as AI capabilities evolve, through a controlled release process rather than silent continuous change.

• Employee AI usage policy

  An internal policy governs how NotAI employees may use AI tools in their work.

• Algorithmic fairness commitment

  We review detection models for bias before major releases. This is a standing internal practice and commitment, not a third-party audit.

Security grades

We do not self-report security grades. The independent checkers below run live against our production configuration, so you can verify the current results yourself.