Where we are today, and where we’re going. No certifications we don’t have, no vague claims.
Last updated November 6, 2026
Our approach
NotaryBoard is built on a simple security idea: the safest data is data we never collect. We sync free/busy times only. Event titles, descriptions, attendees, and locations never reach our servers. Everything below describes what we do with the data we do hold, what we haven’t done yet, and what’s coming.
Controls in place today
Calendar tokens encrypted at rest with AES-256-GCM, with the encryption key held outside the database. A database dump alone does not expose calendar access.
All traffic encrypted in transit with TLS.
Agencies share one database, and each agency’s records are tied to that agency. The app checks that ownership whenever a signed-in user reads or changes a record, and an automated test tries to reach one agency’s data from another to confirm those checks hold.
Direct outside access to the database is blocked: its public API is disabled, and row-level security is on for every table.
Minimal calendar scopes: Google calendar.freebusy (read) and calendar.events.owned (write our own hold events only). We never request scopes that expose event contents.
Data minimization by design: no analytics, no session recorders, and no tracking inside the signed-in product, with one narrow exception: when a new agency account is created by someone who accepted our cookie banner, our server sends a single signup event to Meta to measure our ads. It never includes your name, email, signings, or calendar data. Our public marketing pages use two advertising pixels (Meta and LinkedIn) that load only after a visitor clicks Accept on our cookie banner, never for browsers that send Global Privacy Control, and are disclosed in our Privacy Policy.
Card data never touches our systems. Payments are handled entirely by Stripe.
Authentication handled by Clerk; we never see or store passwords.
Each agency has an append-only activity log of signing, roster, office, and billing actions. Agency admins can view it and export it.
Disconnecting a calendar immediately deletes its stored tokens and all synced free/busy data.
Separation from 247 Closers
NotaryBoard is operated by 247 Closers LLC, which also runs the 247 Closers signing service. NotaryBoard data is never used for that signing service: not to solicit an agency’s clients, recruit its notaries, or send it signings. This is a written commitment in our Terms of Service and Privacy Policy.
What we don’t have yet
NotaryBoard does not currently hold SOC 2 or ISO/IEC 27001 certification, and has not yet undergone independent penetration testing. We’re an early-stage company and we’d rather tell you that directly than hide behind vague language.
Roadmap
As we grow, in stages:
Documented incident response plan
Formal access control and vendor management documentation
Independent penetration testing
SOC 2 Type II audit
Security questionnaire support for agency vendor reviews. Agencies can email us their questionnaire today and we’ll answer it honestly.
Subprocessors
Vercel: hosting
Supabase: database (US)
Clerk: authentication
Stripe: billing
Resend: email
Twilio: SMS
Sentry: error monitoring (no session recording)
Google and Microsoft: calendar sync for connected accounts
Our status page is powered by Better Stack; Better Stack’s certifications are theirs, not ours.
