Where we are today, and where we’re going. No certifications we don’t have, no vague claims.
Last updated August 27, 2026
Our approach
NotaryBoard is built on a simple security idea: the safest data is data we never collect. We sync free/busy times only — event titles, descriptions, attendees, and locations never reach our servers. Everything below describes what we do with the data we do hold, what we haven’t done yet, and what’s coming.
Controls in place today
Calendar tokens encrypted at rest with AES-256-GCM, with the encryption key held outside the database. A database dump alone does not expose calendar access.
All traffic encrypted in transit with TLS.
Database access restricted with row-level security; the database’s public API is disabled.
Minimal calendar scopes: Google calendar.freebusy (read) and calendar.events.owned (write our own hold events only). We never request scopes that expose event contents.
Data minimization by design: no analytics, no session recorders, and no tracking of any kind inside the signed-in product. Our public marketing pages use one advertising pixel (Meta), disclosed in our Privacy Policy.
Card data never touches our systems — payments are handled entirely by Stripe.
Authentication handled by Clerk; we never see or store passwords.
Disconnecting a calendar immediately deletes its stored tokens and all synced free/busy data.
What we don’t have yet
NotaryBoard does not currently hold SOC 2 or ISO/IEC 27001 certification, and has not yet undergone independent penetration testing. We’re an early-stage company and we’d rather tell you that directly than hide behind vague language.
Roadmap
As we grow, in stages:
Documented incident response plan
Formal access control and vendor management documentation
Independent penetration testing
SOC 2 Type II audit
Security questionnaire support for agency vendor reviews — agencies can email us their questionnaire today and we’ll answer it honestly.
Subprocessors
Vercel — hosting
Supabase — database (US)
Clerk — authentication
Stripe — billing
Resend — email
Twilio — SMS
Google and Microsoft — calendar sync for connected accounts
Our status page is powered by Better Stack; Better Stack’s certifications are theirs, not ours.
