Authentication
Passwords are hashed with bcrypt. Sessions use short-lived access tokens with refresh-token rotation and revocation on logout or password reset. Authentication endpoints are rate-limited.
Security & Trust
How we protect your data.
Networkbase holds member information on behalf of the organizations that use it. We are the controller of account data and a processor of the member data our customers entrust to us — and we treat that responsibility as foundational, not a feature.
Controls we have in place
Security built into the product.
Per-organization isolation
Every request is scoped to its organization. Strict multi-tenant isolation and active-membership checks keep one organization’s data from being reachable by another.
Role-based access
Owners, admins, editors, and members get only the access their role requires, enforced server-side on every protected route.
Encryption in transit
Traffic is served over TLS with HSTS and a baseline of hardening headers (content-type, frame, and referrer protections).
Audit logging
Sensitive actions such as personal-data exports and account deletions are written to an append-only audit log that records the actor, action, and request origin.
Payments
Payments run through Stripe. We never store card numbers — only Stripe references — and verify webhook signatures, keeping our PCI scope minimal.
Monitoring
Errors are monitored with personal information scrubbed from diagnostic data, so we can detect and fix issues without exposing member data.
Incident response
We maintain a documented breach-response runbook mapped to the notification duties under GDPR, PIPEDA, Québec Law 25, the NY SHIELD Act, and the CCPA.
Privacy & compliance
Designed to support the laws our customers answer to.
Networkbase is built to support compliance with GDPR and UK GDPR, PIPEDA, Québec Law 25, the CCPA/CPRA, the NY SHIELD Act, and CASL/CAN-SPAM for commercial email.
Member privacy rights
Members can download a copy of their data and delete their account from their profile. Consent for terms, privacy, and marketing email is recorded at sign-up, and every campaign carries a one-click unsubscribe and a physical mailing address.
Customers as controllers
For the member data we process on your behalf, you remain the controller. A Data Processing Agreement is available, and we publish the sub-processors we rely on.
AI and member data
Engagement and health scores are computed by transparent rules inside Networkbase — member data never leaves the platform to produce a score. AI drafting is powered by OpenAI, a listed sub-processor, and receives only the content and activity context needed for the draft; per OpenAI's API terms it is not used to train their models. The AI never makes automated decisions about members: every draft is reviewed and approved by your team before anything is sent.
Reporting a vulnerability
If you believe you’ve found a security issue, please email security@networkbase.ca rather than opening a public report, and allow us reasonable time to investigate and remediate before disclosure. We appreciate responsible disclosure.
Talk to us about security