The evidence does not depend on trusting us

Personal data (Ley 1581 de 2012)

For the recipient's data, the lawyer or firm is the data controller (responsable) and Notificado is the processor (encargado): we process it on their behalf, only to send the notification and prove it. For your account data, we are the controller.

• The processing relationship is governed by the transmission contract included in the terms of service.
• The verification page never shows the message content or any personal data of the recipient.
• Every data subject can access, update, correct and delete their data on the terms of our policy. Erasure does not reach the evidence of a notification while it must be retained: it is kept to meet legal and contractual obligations, among them the proof of the notification in the proceeding (Decreto 1377 de 2013, art. 11).

Where it is enforced

In the transmission contract included in the terms of service, and in the data processing policy.

Immutable storage for at least 10 years

Frozen messages, documents, timestamps, constancias and the providers' original responses are kept in Amazon S3 with Object Lock in compliance mode for at least ten years. During that time no one can delete or overwrite them, not even a Notificado administrator.

• Encryption in transit (TLS) on the connections to our site, our API and storage, and the storage provider's encryption at rest (Amazon S3) for the evidence.
• An insert-only event log: the database refuses any update or deletion.
• A nightly check of the whole chain and a daily anchor, timestamped.

Restricted, audited access

Each firm sees only its own cases and notifications. When our team looks at a customer's data, the read is logged with who, when and what; every evidence download is logged as an event too.

• Least-privilege roles for our own team: operations, support, finance and compliance.
• API tokens are stored only as a hash, shown once and revocable at any time.
• An AI assistant never sends on its own: a person confirms every send.

Who signs the constancias

Every constancia is signed by VENOMTECH S.A.S. with an electronic signature (PAdES) made with its own key. That key's X.509 is self-issued, which is why a PDF reader may show the signer's identity as unknown. That warning does not mean the document changed. To check the signature, compare the signer's SHA-256 fingerprint with the one published in the evidence method, or upload the PDF on the verification page.

Vendors behind interfaces

Mail, timestamping and constancia signing go through our own interfaces, not a vendor's format. The evidence uses open standards (RFC 3161 for timestamps, PAdES for the signature, SHA-256 and RFC 8785 for fingerprints), so it stays verifiable even if we change vendors.

If an incident happens

If a security incident affects personal data, we inform the affected customers, who are the data controllers, and Colombia's Superintendencia de Industria y Comercio, as Ley 1581 requires.

Who operates Notificado

Notificado is a service of VENOMTECH S.A.S., a Colombian company with NIT 901.991.367-7 and D-U-N-S number 474254581. The service: soporte@notificado.co. Your personal data: privacidad@notificado.co. Security and vulnerabilities: seguridad@notificado.co. Phone: +57 333 227 3151.

External security audit

The cybersecurity specialists at HiScore S.R.L., a Romanian firm, carried out a full audit of Notificado's data security and cybersecurity, and Notificado passed it. The audit covered:

• The infrastructure.
• The source code.
• The OWASP Top 10 vulnerability categories.
• Access control.
• Data handling.
• Key custody and the cryptographic algorithms in use.

Auditor

HiScore S.R.L., Romania

Date

28 October 2026

Scope

Data security and cybersecurity

Result

Passed

Report a vulnerability

If you find a security flaw, write to us with the steps to reproduce it. We ask that you do not access other people's data, do not degrade the service, and give us reasonable time to fix it before you publish.

Write to seguridad@notificado.co