Your data is safe with us

NotaGRC is hosted exclusively on Railway, a modern cloud platform built on top of Google Cloud Platform (GCP). This means your data benefits from GCP's global security baseline while Railway adds its own hardened deployment layer on top.

• Encryption in transit: All traffic is served over TLS 1.2+ — enforced by Railway's edge, with HTTPS termination before requests ever reach the app.
• Encryption at rest: PostgreSQL databases are encrypted at rest using AES-256 by default.
• Network isolation: Services run in isolated containers with private networking between the app and database — the database is never exposed to the public internet.
• Automatic backups: Railway PostgreSQL includes automated daily backups with point-in-time recovery.
• DDoS protection: Cloudflare-backed edge provides DDoS mitigation and rate limiting at the network layer.

Beyond the platform, NotaGRC applies security best practices throughout the application itself:

• Password hashing: All passwords are hashed with bcrypt (cost factor 12) — we never store plain-text passwords and cannot recover them.
• Session management: Server-side sessions with cryptographically signed, HTTP-only, secure cookies. Sessions expire after 7 days and are invalidated on logout.
• CSRF protection: Form submissions are scoped to authenticated sessions; sensitive mutations require POST with active session.
• Secure headers: trust proxy is configured to respect Railway's reverse proxy, ensuring cookies are correctly marked Secure in production.
• Input validation: All user input is validated server-side before any database operation. Prisma's parameterised queries prevent SQL injection by design.
• Role-based access control: Admin and member roles are enforced at the middleware layer — members cannot access billing, user management, or organisation settings.
• Password reset tokens: One-time use tokens generated with crypto.randomBytes(32), expire after 1 hour, and are invalidated immediately on use.

NotaGRC uses organisation-level data isolation. Every piece of data — risks, vendors, BAU activities, BIA records, users — belongs to a single organisation and is always queried with an orgId filter.

• Logical isolation: All tenants share the same database instance, but every row is owned by an organisation. Prisma's query layer enforces this at the ORM level.
• Session scoping: Your orgId is set at login from the database — it cannot be overridden by user input.
• No cross-tenant APIs: There are no administrative APIs that expose bulk data across organisations. Internal admin access requires direct database access, which is logged and audited by Railway.
• User management: Only admins within an organisation can add or remove users. Users cannot move between organisations.

NotaGRC uses Resend to deliver email notifications (password resets and risk review alerts). Resend is a developer-focused email infrastructure provider with a strong security posture:

• What we send to Resend: Recipient email address, recipient name, email subject and body (which may include risk titles and dates for digest emails).
• What we never send: Passwords, session tokens, full risk descriptions, financial data, or any other sensitive record content.
• TLS enforced: All communication between NotaGRC and Resend's API is over HTTPS/TLS 1.2+.
• Opt-out available: Email notifications are opt-in per user. You can disable them at any time in Settings → Notifications.

All payment processing is handled by Stripe, a PCI DSS Level 1 certified payment processor. NotaGRC never touches, stores, or transmits your card details.

• PCI DSS Level 1: The highest level of payment card industry compliance. Stripe undergoes annual audits by a qualified security assessor.
• No card data on our servers: When you subscribe, you are redirected to a Stripe-hosted checkout page. Card numbers never pass through NotaGRC's servers.
• Webhook verification: All incoming Stripe webhook events are verified using HMAC-SHA256 signature validation — we reject any event that cannot be cryptographically verified as originating from Stripe.
• Stored identifiers only: We store only your Stripe Customer ID and subscription status — not card details, CVVs, or billing addresses.