Security & compliance

How Notifuse handles security, who is responsible for what, and what happens when a vulnerability is found.

Last updated October 24, 2026

Self-hosted or Cloud: who does what

Self-hosted

You run Notifuse on your own servers, with your database and your network rules. We provide the product and the controls below. Your data does not pass through us.

Notifuse Cloud

We run it in the EU (OVHcloud in France, Google Cloud in Belgium). Each deployment gets its own PostgreSQL server, daily backups with point-in-time recovery, and encryption at rest and in transit.

Product controls

  • Single sign-on (OIDC). Users sign in through your identity provider (Microsoft Entra ID, Keycloak, Okta, Google Workspace…). Your MFA rules apply, and tokens are checked on the server. Documentation
  • Granular permissions & scoped API keys. Set read and write access per area, for users and API keys. Changes take effect straight away. Documentation
  • Audit logs. A record of admin actions: who did what, from where, and whether it was allowed. It cannot be edited, it can be exported, and you choose how long it is kept (Enterprise licence). Documentation
  • Workspace isolation. Each workspace has its own database, contacts, campaigns and settings. Entities cannot see each other's data. Documentation
  • Offline licence verification. Licence keys are checked locally, inside the program. No account is needed and nothing about your installation is sent to us. How licensing works
  • Auditable code. The source code is public. Each release is published under BSL 1.1 and becomes AGPL-3.0 after four years. Repository · LICENSE

When a vulnerability is found

Please report vulnerabilities privately, through GitHub or by email at hello@notifuse.com. We reply within three business days and give a first assessment within ten business days. We publish the details once a fix is out, and we credit reporters who want to be named.

Fixes are published in the latest release, with a public note saying which version fixes the problem. If you self-host, please keep up with releases — there are about four a month. Standard licences do not include a guaranteed fix deadline; one can be agreed in a Custom licence.

The full policy is in SECURITY.md. Published advisories are on GitHub.

Data protection

For your recipients' data, you are the controller and we are the processor (GDPR Article 28). Our data processing terms are in section 9.4 of our Terms. They cover breach notification and help with access or deletion requests. Our sub-processors are OVHcloud (France), Google Cloud (Belgium), Stripe and Postmark (United States). They are listed in our Privacy Policy, and we tell customers before we add or change one.

If you self-host, your data stays on your infrastructure and none of this goes through us.