Security and compliance
MFA on every plan, org-scoped audit logs, and role-based access control on Team; Enterprise adds SSO (SAML/OIDC) and SCIM.
Notifly treats security features as part of the product rather than an enterprise upsell. Multi-factor authentication is available on every plan, including the free one; role-based access control and translations arrive with the Team plan; SSO and SCIM are Enterprise features. The audit log is org-scoped and exportable.
Role-based access control (RBAC)
Permissions are enforced by a guard on every protected API route, and the same permission vocabulary drives everything else in the platform — including the scopes AI clients are granted on the MCP server. Invitations default to the least-privileged Viewer role on both single and bulk invite paths, so nobody gets owner-level access by accident.
Audit log
Every sensitive mutation writes an org-scoped audit row that captures a snapshot of the acting user (name and email) at write time. The audited surface is pinned by tests in the codebase, so new sensitive endpoints cannot silently skip the trail.
- Retention is configurable via
AUDIT_LOG_RETENTION_DAYS(default 730 days; a value of 0 or below disables expiry). - Export the trail with
GET /v1/audit-logs/exportin CSV or NDJSON format (requires the audit-log read permission). - Deleting an organization purges its audit trail along with the rest of its data.
Multi-factor authentication (MFA)
TOTP-based MFA is built in, with enrollment endpoints under /auth/mfa/enroll. Organizations can require MFA: when an org sets mfaRequired, password and OAuth sign-ins must complete TOTP enrollment before a session is issued.
Enterprise SSO and SCIM
The Enterprise plan adds single sign-on via SAML and OIDC, plus SCIM directory sync for automated user provisioning and deprovisioning. SSO can be enforced per organization — enforced-SSO orgs reject non-SSO sessions (with an owner break-glass path) — and SCIM deprovisioning immediately revokes the affected user's tokens.
Multi-organization support
Users can belong to multiple organizations and switch between them in the dashboard. All data — workflows, subscribers, messages, audit rows — is scoped to an organization and its environments.
In-app inbox
A real-time notification feed inside your product, delivered over websockets, with an embeddable Inbox component.
REST API
The versioned Notifly REST API at api.notifly.io — quickstart, API-key authentication, environments, errors, pagination, idempotency, rate limits, and subscriber credentials.