Security

Where Nowlark keeps your data, how keys and sign‑in are protected, company sign‑in and SCIM, the activity log, and how to report a problem.

The Privacy Policy has the full detail on what is kept and for how long.

Where your data lives#

Our server and database run on Fly.io in Chicago, United States. The database is on an encrypted volume.
All traffic, from the apps, the console, your tools and your forms, uses HTTPS.
The host takes a daily snapshot of the database and keeps each one for 5 days, so anything deleted is gone from every copy within 5 days.
Notifications pass through Apple's Push Notification service on their way to iPhone, iPad, Mac and Apple Watch, as every notification on those devices does.

A notification's link can open another app, such as Slack or Things, and can carry up to three link buttons.
Opening another app asks first. The first time a source opens a given app, the device asks before opening it, and remembers Open for that source and app only. A different source, or a different app, asks again. Web pages open without asking.
Links that could run code or read the device are refused when the notification is sent: javascript:, data:, file:, vbscript:, blob:, about:, and links with no scheme. The apps and the team console refuse them again before opening anything.

Keys are stored only as one-way hashes. Your account key, every sending key and every transfer code are kept as hashes, so nobody, including us, can read one back. A key is shown once, when it is made.
The console has no passwords. People sign in with a passkey on their own device. The link that creates one works once and lasts ten minutes.
A lost phone ends every session. Replacing your key in the app with the option to sign everything else out removes every console session and passkey at once.
Internet addresses are kept only as keyed hashes, for rate limits, and deleted within two hours.

Company sign‑in works with Okta and other OpenID Connect providers. The owner chooses which email domains the team accepts and which provider groups are admins and which are senders.
SCIM 2.0 provisioning keeps the team in step with your identity provider. When someone leaves the company and the provider deactivates them, they are removed at once, from their channels, their keys, their copies of team alerts and their console sessions.
Roles limit who can do what: members receive, senders can also make channel keys, admins manage the team and the owner manages billing and ownership. Teams lists each one.

The activity log records who changed what on a team, newest first. It never records message text, keys or form content.

Webhooks and callbacks are signed. Every delivery carries X-Nowlark-Signature, an HMAC-SHA256 over a timestamp and the body, so your server can tell a real delivery from a forged or replayed one.
Payments never touch our server. Paddle, our reseller, takes the payment and holds card details. We receive only the plan, its status and its dates.
We do not sell or share your data. These are the only companies that process it:

Company	What it does for Nowlark
Apple	Carries each notification to your devices, and provides the App Store and iCloud
Fly.io	Hosts our server and database in Chicago, United States
Paddle	Takes the payment for team plans and holds the buyer's payment details
Google	Analytics for visits to our websites only; the app sends Google nothing

The Privacy Policy says what each one receives.

Notifications are deleted automatically once they are older than the history length set in the app.
Form messages are kept for 24 months, and any screenshots or logs sent with them for 180 days.
Settings › Delete Account in the app erases the account, every notification, every key and every device straight away.

If you find a security problem in Nowlark, email support@nowlark.com with what you found and how to reproduce it. Every report gets a reply.