Security and trust, built for regulation & compliance.

Built for teams where compliance and accuracy are non-negotiable

SECURITY & TRUST

Enterprise-grade security for sensitive operations

User roles list with icons and descriptions alongside performance charts for runs, coverage, and resolution trends.

Protect Data at Every Layer

Notch applies cryptographic controls when processing and storing data, with encryption in transit using TLS 1.2 and encryption at rest using AES-256.

Secure the Network Perimeter

Production services run on leading cloud infrastructure, including AWS, with network protection through Amazon VPC, web application firewalls, and regular vulnerability scanning.

Control Access with Confidence (SSO, 2FA, RBAC)

Platform access is enforced through Single Sign-On, Two-Factor Authentication, Role-Based Access Control, and least-privilege principles, ensuring users receive only the permissions required for their role.

Support Privacy Requirements

Notch supports GDPR, CCPA, EU AI Act readiness with purpose limitation, data minimization, configurable retention, secure deletion, and vendor controls such as DPAs and subprocessor transparency.

Maintain Security Accountability

Audit logs capture activity, errors, and warnings across production systems, while regular testing and a responsible disclosure program help identify and resolve issues quickly.

5-LAYER COMPLIANCE ARCHITECTURE

Scale AI across complex operations without losing control

Validate Every Interaction

A real-time judge evaluates AI conversations before they reach the customer, helping block unsupported, incomplete, or off-policy responses.

Defend the Workflow

Technical defenses protect agents from prompt injection, instruction smuggling, tool abuse, and unauthorized actions across connected systems.

Enforce Deterministic Controls

Authentication status, verification level, user role, policy rules, payout caps, claim thresholds, and account restrictions are enforced as hard system constraints.

Apply Rules by Jurisdiction

Compliance logic can adapt by state, region, product, or business line, applying the right rules for frameworks such as state DOI requirements, GDPR, or FCA expectations.

Manage Change Safely

Every configurable part of the platform is version controlled, so teams can draft, test, stage, monitor, roll back, and lock agent changes before scaling them.

User interface showing policy details for awaiting clinical review and agent management panel with policy versions.

Learn more about security and auditing at Notch

Trust and reliability

Notch is purpose-built for the compliance demands of regulated industries. Our architecture is designed from the ground up to satisfy the requirements of frameworks including SOC 2 Type II, ISO 27001, GDPR, CCPA, and sector-specific obligations such as the FCA Consumer Duty and FFIEC guidance. Our AI agents operate within auditable, policy-bound guardrails, providing the control, explainability, and oversight that regulated environments require.

At Notch, we believe that trust is not a feature - it is the foundation upon which every customer interaction is built. As organizations in financial services, healthcare, insurance, and other highly regulated sectors adopt agentic AI for customer support, the stakes of getting security, privacy, and compliance right have never been higher. This Trust Center is our public commitment to meeting that standard: a transparent, up-to-date record of the security controls, data protection practices, compliance certifications, and governance frameworks that underpin every Notch deployment.

We partner with compliance, legal, and security teams as readily as we partner with customer experience teams, because in regulated domains, those conversations are inseparable. If you have questions that go beyond what is documented here, our security and compliance team is available at [email protected].

Data Protection

Our team implements cryptographic controls when processing and storing data and performs encryption in accordance with industry standards. All Notch web traffic sent over the public internet is encrypted in transit using the TLS v1.2 protocol, and encryption at rest is performed with AES-256

Network Security

Notch's production services are hosted on leading cloud infrastructure providers like Amazon AWS. We use Amazon's Virtual Private Cloud to protect our network perimeter in addition to web application firewalls and regular vulnerability scanning.

Access Control

Notch maintains audit logs of all activity, errors, and warnings on production systems and uses single sign-on and 2-factor authentication to enforce application access control. Levels of access are granted on a principle of least privilege and use Role-Based Access Control.

Responsible Disclosure Program

We treat the security of our customers very seriously, which is why we carry out rigorous testing and strive to write secure and clean code. Despite our meticulous testing and thorough QA, sometimes bugs occur. For this reason, we encourage the community to responsibly disclose any bugs or issues. Please send reports to [email protected]

AUTONOMOUS ORGANIZATION

Autonomous AI for operations leaders ready to turn complexity into advantage.

Deployed in weeks. Autonomous in months. Compounding for years.

Book a demo

Deliver better outcomes across every metric that matters

Get more done across every channel, system, and workflow.

Decouple revenue growth from operational cost.

Every action governed, traceable, and audit-ready.