Notoro is a system of record for money and compliance decisions. It is built so that every company sees only its own data, every change is recorded and nothing can be quietly altered.
Every row in the database carries the company it belongs to, and the database itself enforces the boundary with row-level security. Application code cannot read across companies even by mistake. Sharing between companies happens only through explicit, revocable shares, such as a Compliance Passport link.
Every change, proposal, override, login, export and share is an event. Events are never edited or deleted. Each event carries a hash of the one before it, so the chain can be re-verified at any time and any alteration shows.
Data is encrypted at rest with AWS KMS managed keys and in transit with TLS 1.2 or later. Mailbox credentials are envelope-encrypted with a dedicated key.
Everything runs in AWS Canada (ca-central-1). Databases, documents, email storage and backups stay in that region. AI models are called through Amazon Bedrock with cross-region inference inside AWS.
The database is continuously backed up with point-in-time recovery. Documents are versioned and kept in a bucket that never allows public access.
Each service runs with the narrowest set of permissions it needs. Staff access to production data is logged and limited to what support requires.
Notoro tracks payments. It never holds, transfers or initiates funds and never stores bank credentials.
You can export your data in full at any time. On request we delete a company’s data, subject to legal retention where it applies, and confirm in writing.
AI reads documents and drafts messages. It never sends a message or changes a load, a settlement or a credential on its own. Every AI proposal is recorded with its confidence and reasoning, and a person approves it unless you have set a threshold for that task.
| Provider | Purpose |
|---|---|
| Amazon Web Services | Hosting, storage, email delivery (ca-central-1) |
| Anthropic via Amazon Bedrock | Document reading, translation, drafting |
| Twilio | SMS and voice |
| Meta | WhatsApp Business messaging |
| Bank of Canada | Published USD/CAD exchange rates (public data, nothing shared) |
Write to security@notoro.app. We acknowledge within one business day and keep you informed until it is resolved.