Notice Platform Security and Compliance

Notice is a cloud application that provides meeting scheduling as a service. Our platform creates a seamless experience to schedule meetings through securely integrating with calendar providers to check availability.
Our software is designed to request the most limited access to customer resources to achieve a seamless scheduling experience. We are continuously mindful of our customer’s privacy and limit access to all customer data on a need to know basis internally.
Notice applies best security practices retaining a minimal amount of customer data and operating with the fewest privileges necessary to provide a great experience to our users.
This document is meant to be an overview of platform-related privacy, security, and compliance.

Calendar Integrations

Google Calendar and Office365 Integrations

A Notice user may use either the Google Calendar or Office365 integrations to connect their calendar with Notice to simplify scheduling. Notice is built to only access the minimum data needed from connected calendars to deliver its service. For example, the Notice application only checks the duration and free/busy status of the events in your Google calendar so that we do not book when you are busy. Notice is designed not to store the details about the appointments in your calendar including details such as who you are meeting with, their email, the meeting title or any other details about the appointments in your calendar.

Notice Outlook Plug-in

The Notice Outlook Plug-in integration allows the Notice platform to check the duration and free/busy status of the events in your calendar so that we do not book you when you are busy. No other personally identifiable information, including subject, notes, and attendee emails are available or transmitted to Notice. The Notice Platform uses websockets to communicate when new bookings are available with the Notice for Outlook plug-in. Notice will write appointment time, duration, subject and scheduled attendee information from Notice to Outlook. All data is encrypted in transit using TLS. Data stored at rest in the underlying storage is encrypted including automated backups, read replicas, and snapshots.

iCloud Calendar Integration

The Notice iCloud Calendar integration uses your iCloud credentials to access the iCloud API. Apple has an all or nothing approach to data access in that the same credentials are used for all services. While Notice securely stores and restricts access to the iCloud credentials we collect, Notice recommends setting up two-factor authentication on iCloud accounts and using an app-specific password when setting up the Notice iCloud Calendar Integration.

Authenticating with calendar integrations

We avoid collecting third-party passwords by utilizing OAuth authentication with Office365 and Google Calendar. Notice users can disconnect their calendar connection at any time through the Account Settings page within their Notice account.
When using the Notice Outlook Plug-in, Notice requires installation on customer devices to read calendar conflicts and schedule events. Most of our customers prefer to use OAuth calendar integrations.

Booking Pages

The Notice platform allows users to customize booking pages to collect relevant information from invitees. Notice is not intended to be used by users to collect sensitive personally identifiable information.

Data Encryption

• All connections from the browser to the Notice platform are encrypted in transit using TLS SHA-256 with RSA Encryption.
• All data is encrypted at rest.
• Notice user passwords are stored as salted password hashes
• User passwords for the iCloud Calendar integration are encrypted

Physical Infrastructure

The Notice application is hosted on Microsoft Azure. MS Azure data centers are FedRamp-certified and are also accredited under:

• ISO 27001
• SOC 1, SOC 2, SOC 3
• FedRAMP
• HITRUST
• MTCS
• IRAP
• ENS

For additional information see:

https://docs.microsoft.com/en-us/azure/compliance/

Vulnerability Management

We keep our systems up to date with the latest security patches and continuously monitor for new vulnerabilities through compliance and security mailing lists. This includes automatic scanning of our code repositories for vulnerable dependencies. All of our services run in containers that isolate processes, memory, and the file system using LXC while host-based firewalls restrict applications from establishing local network connections. The services are configured with tight network security constraints to further limit any potential risk. Azure regularly conducts internal vulnerability assessments and patch the underlying systems.

Incident Response Plan

Identification

Notice routinely monitors our external services and open source libraries for security issues and has executed Data Processing Addendums (DPA) with our vendors to ensure prompt notification of data breaches. Notice continuously scans Notice for service interruptions, performance degradation, and security vulnerabilities with automated tools to immediately alert our engineers when an incident has been detected. Users may also report security issues to the security@Notice.com

Containment

Whenever our engineering team is alerted to a security issue, the team determines what systems are affected and quickly contains the problem by disconnecting all affected systems and devices. Because all of our services run in containers that isolate processes, memory, and the file system they are easily replaced and updated in their entirety inhibiting further escalation.

Recovery

If data was found to be affected, it is restored from clean backup files, ensuring that no vulnerabilities remain. Secondary backups are also stored in Google Cloud. Systems are monitored for any recurrence. Ephemeral services are patched and redeployed eliminating any chance of malware persistence.

Retrospective

The Notice engineering team analyzes every operations incident and how it was handled, making recommendations for better future response and for preventing a recurrence.

Change Management Plan

New releases to the Notice Platform are thoroughly reviewed and tested to ensure high availability and a great customer experience. Changes to our codebase are required to include unit tests, integration tests, and end-to-end tests. Changes are also run against our continuous integration server. This enables us to automatically detect any issues in development.
Once a changeset is completed, it is manually peer reviewed by one or more members of the engineering team. The changeset is then evaluated and manually tested by our quality assurance team to thoroughly test areas of expected impact, regression test, and further evaluate the user experience.
After a changeset is released, we continue to monitor application exceptions and log exceptions. These exceptions are regularly reviewed and triaged for resolution. Performance impacts of the changeset are monitored through several monitoring services.

Employee Screening and Policies

As a condition of employment, all Notice employees undergo pre-employment background checks and receive training during onboarding and throughout their employment on company policies, security, GDPR, and other related security, privacy, and compliance topics.

VIEW MORE NOTICE PLATFORM