diff --git a/app/assets/images/product/security-review-message.png b/app/assets/images/product/security-review-message.png new file mode 100644 index 000000000..ffb59076c Binary files /dev/null and b/app/assets/images/product/security-review-message.png differ diff --git a/app/content/get-started.md b/app/content/get-started.md index 7846c0fe6..47757b2c1 100644 --- a/app/content/get-started.md +++ b/app/content/get-started.md @@ -1,43 +1,21 @@ # Get started -1. ## Check if Notify.gov is right for you -

Read about our features, pricing and roadmap.

+1. ## Everyone starts in [Trial Mode](/using-notify/trial-mode) +Explore Notify, add team members, and practice [sending messages to teammates](/using-notify/trial-mode). +2. ## Personalize content +Learn how to [personalize messages](/using-notify/guidance) to increase response. -2. ## Create an account - {% if not current_user.is_authenticated %} -

Create an account for free and add your first Notify service. When you add a new service it will start in trial mode.

- {% else %} -

Create an account for free and add your first Notify service. When you add a new service, it will start in trial mode.

- {% endif %} - -3. ## Write some messages - {% if True %} -

Add message templates with examples of the content you plan to send. You can use our guidance to help you.

- {% endif %} - -4. ## Set up your service - {% if not current_user.is_authenticated or not current_service %} -

Review your settings to add message branding and sender information.

-

Add team members and check their permissions.

- {% else %} -

Review your settings to add message branding and sender information.

-

Add team members and check their permissions.

- {% endif %} +3. ## Check delivery status +[Analyze the delivery](/using-notify/delivery-status) of your messages and download reports +4. ## View messaging limits +Learn about message _parts_ and [how limits are calculated](/using-notify/pricing). 5. ## Start sending messages - {% if not current_user.is_authenticated or not current_service %} -

When you’re ready to send messages to people outside your team, go to the Settings page and select Request to go live. We’ll approve your request within one working day.

- {% else %} -

You should request to go live when you’re ready to send messages to people outside your team. We’ll approve your request within one working day.

- {% endif %} +To remove the restrictions of Trial Mode and begin sending messages to clients complete the [Live Campaign Form](https://airtable.com/appe4n7jYOALPLcyU/shrIPWnLTw9U1fclL). +We’ll respond within one business day. - - - +### Questions? +[Contact the Notify team](/support) diff --git a/app/templates/views/guidance/index.html b/app/templates/views/guidance/index.html index 7d43f81c3..e754ef245 100644 --- a/app/templates/views/guidance/index.html +++ b/app/templates/views/guidance/index.html @@ -11,115 +11,229 @@

Guidance

-

This guidance is for teams using Notify.gov to send text messages.

- -

It explains how to:

+

Notify allows you easily to create templates for messages for your recipients. You can customize messages to encourage + your recipient to manage their benefits and increase follow through.

+

Below we explain how to:

-

Edit and format messages

+ {# Format content #} +

Format your content

+

Effective texts will help your message recipients take the steps needed to secure and keep the benefits and services + they depend on. To craft an effective text:

-

This section explains how to:

-

Format your content

- -

You can see a list of formatting instructions on the edit template page:

- -
    -
  1. Go to the {{ service_link(current_service, 'main.choose_template', 'templates') }} page.
  2. -
  3. Add a new template or choose an existing template and select Edit.
  4. +

    To create and format your message

    +
      +
    1. All messages start from a template
    2. +
    3. Click “Send Messages”. You’ll see existing templates.
    4. +
    5. Add a new template or choose an existing template and select Edit.
    - - -

    When composing a text message, write URLs in full and Notify will convert them into links for you. -

    - -

    You cannot convert text into a link. - -

    - -

    We do not recommend using a third-party link shortening service because:

    + {# Add links #} + +

    When composing a text message, links to websites or online applications can help your recipient respond quickly.

    -

    Personalize your content

    +

    About link-shortening services

    +

    We do not recommend using a third-party link-shortening service because:

    + -

    To personalize the content of your messages, add a placeholder to the template.

    + {# Personalize content #} +

    Personalize your content

    +

    Personalizing your content can increase response rates and help the recipient know the text is legitimate.

    + -

    Placeholders are filled in with details, like a name or reference number, each time you send a - message.

    - -

    To add a placeholder to the template:

    - -
      -
    1. Go to the {{ service_link(current_service, 'main.choose_template', 'templates') }} page.
    2. -
    3. Add a new template or choose an existing template and select Edit.
    4. -
    5. Add a placeholder using double brackets. For example: Hello ((first name)), your reference is - ((ref number)).
    6. -
    7. Select Save.
    8. +

      To personalize your content

      +
        +
      1. Add a placeholder to your content by placing two brackets around the personalized elements.
      2. +
      3. You can manually enter the personalized content or you can upload a spreadsheet with the details and let Notify do the + work for you. See data preparation.
      -

      When you send a message you can either:

      +

      Example

      +

      To personalize with the recipient's first name and include a reference number:

      +

      State WIC: Hello ((first name)), your reference is ((ref number)). Please provide this number when you call 123-123-1234 to make an appointment.

      - + {# Add conditional content #} +

      Add conditional content

      +

      Conditional (or optional) content appears only when a recipient meets certain criteria. This feature allows you to make + all or part of the message contingent upon specific criteria associated with the recipient.

      -

      If you upload a list, the column names need to match the placeholders in your template.

      - -

      Add optional content

      - -

      To add optional content to your messages:

      - -
        -
      1. Go to the {{ service_link(current_service, 'main.choose_template', 'templates') }} page.
      2. -
      3. Add a new template or choose an existing template and select Edit.
      4. -
      5. Use double brackets and ?? to define optional content. For example, if you only want to show something to people - who are under 18: ((under18??Please get your application signed by a parent or guardian.))
      6. -
      7. Select Save.
      8. +

        To add conditional content

        +
          +
        1. Use two brackets and ?? to define the conditional content.
        2. +
        3. You can manually enter the conditional content or you can upload a spreadsheet with the personal details and let Notify + do the work for you. See data preparation.
        -

        For each person you send this message to, specify ‘yes’ or ‘no’ to show or hide this content. You - can either:

        +

        Examples

        +
          +
        1. If you only want to show something to people who are under 18: +
          +

          State SNAP: Renewal applications are due by March 15. ((under18??Please get your application signed by a parent or + guardian.))

          +
        2. +
        3. + If you want to make people who are homebound aware of the option of virtual visits (but not other message recipients): +
          +

          State Medicaid: Please call 123-123-1234 to schedule an appointment. ((homebound??Virtual visits are available.))

          +
        4. +
        5. + If you want to send a messages in different languages to different recipients: +
          +

          ((English??We’ve identified unauthorized use on your EBT account. Call the phone number on the back of your card to + cancel or go to your local CSO for immediate replacement.))((Spanish??Hemos identificado un uso no autorizado en su + cuenta EBT. Llame al número de teléfono que aparece en el reverso de su tarjeta para cancelarla o diríjase a su CSO + local para que se la sustituyan inmediatamente.))

          +
        6. +
        -
          -
        • do this yourself
        • -
        • upload a list of personal details and let Notify do it for you
        • + + {# Identify your program #} +

          Identify your program

          +

          You can help your recipients identify your texts as legitimate by customizing your messages to clearly state who they + are from. Consider using the program or benefit name that is most familiar to your recipients.

          + +

          To customize your program name

          +

          To change the text message sender from the default service name:

          +
            +
          1. Go to the Settings page
          2. +
          3. Select “Start text messages with service name.”
          4. +
          5. Change the service name to a familiar program or benefit.
          6. +
          + + {# Prepare your data #} +

          Prepare your data

          +

          The easiest and most efficient way to personalize your content is by uploading a spreadsheet. Notify can accommodate + many file formats and structures.

          + +

          File format

          +

          Notify can accept files in the following formats: CSV, TSV, ODS, and Microsoft Excel.

          + +

          File structure

          +
            +
          • The phone number must be in the first column (Column A) and must be labeled Phone number.
          • +
          • Each column must have a unique name.
          • +
          • If you are using Excel, you must either disable the”auto-date/time format” for time and date columns or convert the file + to a CSV prior to loading. (If you do not, Excel will display date/time data in a confusing format.)
          -

          If you upload a list, the column names need to match the optional content in your template.

          +

          Formatting personalized content

          +

          If you are sending a message with personalized content, such as the first name of the recipient or the appointment time + and location, the names of the column headings have to match the indicator included in the message template.

          +

          For example, if the personalized content is the first name of the recipient, and we are using the spreadsheet below, the + indicator in the message needs to be ((First name)), not ((firstname)) or ((name)).

          -

          Message customization

          +

          Formatting conditional content

          +

          If you are sending messages with conditional content, such as content based on the recipient’s preferred language or + location, the flag to receive the content needs to be captured in its own column with a Yes or No (Y/N) flag.

          -

          Change the text message sender

          +

          Example

          + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          + Example +
          Phone numberFirst nameLast nameSpanishEnglishDateTimeLocation
          123-456-7890LuluPraetherNYNovember 2, 20233:25123 Ford Rd.
          234-567-8901SelaAppelYNNovember 2, 20234:00123 Ford Rd.
          123-456-7890DexterMoseleyNYNovember 2, 20232:00123 Ford Rd.
          -

          The text message sender tells your users who the message is from.

          + {# Preventing fraud #} +

          Preventing fraud

          +

          Texting fraud is ever prevalent and while we can’t eliminate the risk, we can reduce the chances that recipients will + fall victim to fraud.

          +
            +
          1. Never send unnecessary or protected private information.
          2. +
          3. Remind your recipients that text messaging is not a secure means of communication and they should not send you private + information via text.
          4. +
          5. Only include links to websites and online applications that are secure.
          6. +
          7. Send an introductory text letting recipients know you will be texting them and to save the number in their phone.
          8. +
          9. Include an auto-response with the name of your organization and a contact phone number.
          10. +
          -

          To change the text message sender from the default of ‘Notify.gov’:

          - -
            -
          1. Go to the Text message settings section of the {{ - service_link(current_service, 'main.service_settings', 'settings') }} page.
          2. -
          3. Select Manage on the Text message - senders row.
          4. -
          5. Select Change or Add text message - sender.
          6. +

            Examples

            +
              +
            1. Introductory text: +
              +

              State Transit Dept: We're piloting a new way to get important reminders to our staff. Save this number to your phone, + you'll receive updates from us here.

              +
            2. +
            3. Auto-response text: +
              +

              State Agency: This number is unmonitored. To contact us, call us at 123-123-1234. We will never ask for personal details + in a text. If you have questions about how to protect your privacy, see statename.gov/privacy.

              +
            {% endblock %} diff --git a/app/templates/views/roadmap.html b/app/templates/views/roadmap.html index 0784e693d..6ea2e7cfb 100644 --- a/app/templates/views/roadmap.html +++ b/app/templates/views/roadmap.html @@ -22,18 +22,22 @@

            This roadmap is only a guide. It does not cover everything we do, and some things may change.

            You can contact us if you have any questions about the roadmap or suggestions for new features.

            -

            What we’re working on

            +

            What we’re working on

            -

            Now

            +

            Now

            We are investigating the Notify concept, building on the notifications tool pioneered by the UK.

            To do this, we are convening a pilot with a small set of partners.

            Goals during this stage:

              -
            • Achieve compliance to begin piloting, such as ATO and privacy standards
            • -
            • Demonstrate that a government-run notifications tool provides a unique value
            • -
            • Gather data from the pilot to improve the product
            • +
            • Achieve compliance to begin piloting, such as ATO and privacy standards. + +
            • +
            • Demonstrate that a government-run notifications tool provides a unique value.
            • +
            • Gather data from the pilot to improve the product.

            Features prioritized during this stage:

            @@ -46,53 +50,38 @@
          7. Message send/failure analytics
        -

        Next

        + Next

        If the pilot is successful, we hope to recruit additional high-impact partners to improve outcomes for low-income individuals and families.

        Goals during this stage:

          -
        • Complement Notify with practical guidance and support services
        • -
        • Iterate on existing features and implement new features based on what we've learned so far
        • -
        • Hone our measurement approaches to better quantify impact
        • +
        • Complement Notify with practical guidance and support services.
        • +
        • Iterate on existing features and implement new features based on what we've learned so far.
        • +
        • Hone our measurement approaches to better quantify impact.

        Features prioritized during this stage:

        -
          +
          • SMS sending via API integration
          • -
          • Single-level decision two-way messaging (e.g. reply “YES” if, or “NO” if…)
          • Self-service account creation
          • Application status page
          • -
          • Scheduled send option
          • +
          • Improved scheduled send option
          -

          Later

          +

          Later

          In the future, we may decide to expand beyond SMS, or to offer the service government-wide.

          Features to be considered during this stage:

          -
            +
              -
            • Email sending via UI and API
            • -
            • Multiple-level decision two-way messaging (greater than one layer decision-tree)
            • -
            • Open-text reply two-way messaging (rather than reply yes or no, 1 or 2, etc.)
            • +
            • Two-way messaging
            • Multilingual interface and content library options
            • Recurring scheduled send (such as “Send each Monday for 3 weeks”)
            • -
            - - {% endblock %} diff --git a/app/templates/views/security.html b/app/templates/views/security.html index f55ad3de5..d676b37bf 100644 --- a/app/templates/views/security.html +++ b/app/templates/views/security.html @@ -15,22 +15,52 @@
          • manage risks around information
          -

          Data

          -

          On Notify, data is encrypted:

          -
            -
          • when it passes through the service
          • -
          • when it’s stored on the service
          • -
          -

          Any recipient data you upload is only held for seven days.

          - +

          Infrastructure

          -

          Technical security

          - +

          Notify.gov is comprised of two applications both running on cloud.gov:

          +
            +
          • Admin, a Flask website running on the python_buildpack which hosts agency user-facing UI
          • +
          • API, a Flask application running on the python_buildpack hosting the Notify API
          • +
          + +

          Notify.gov utilizes several cloud.gov-provided services through Amazon Web Services (AWS):

          +
            +
          • AWS S3 buckets for temporary file storage
          • +
          • AWS Elasticache (Redis) for caching data and enqueueing background tasks
          • +
          • AWS RDS (PostgreSQL) for system data storage
          • +
          + +

          Notify.gov also provisions and uses two AWS services via a supplemental service broker:

          +
            +
          • AWS SNS for sending SMS messages
          • +
          • AWS SES for sending email messages (note: email function is currently unavailable to users for pilot)
          • +
          + +

          Current security review

          +

          Currently, Notify.gov operates under a GSA Lightweight Authority to Operate (LATO). This federal security authorization + process leverages security controls provided by National Institute of Standards and Technology (NIST). The process is + focused on operational security from both a functional and assurance perspective.

          +

          We are pursuing a full Authority to Operate (ATO)

          + +

          Data

          +

          To send a message, agencies upload a spreadsheet of phone numbers and other necessary data from their existing data + management system. On Notify.gov, data is encrypted when it passes through the service and when it’s stored on the + service.

          +

          Notify.gov is not a system of record and as a result does not have a SORN. Agencies are responsible for managing their + data outside of Notify.gov.

          +
            +
          • Notify stores data within the cloud.gov-managed PostgreSQL database and S3 buckets. The entire database is encrypted at + the disk level.
          • +
          • Additionally, data is encrypted at the field level when it is stored in the database, using OpenSSL 3.0.8 via the Python + cryptography library. The implementation is available on GitHub.
          • +
          + +

          Data retention

          +

          Any recipient data uploaded is only held for seven days; all personally identifiable information (PII) is deleted for + successful messages, so data is retained only for unsuccessful messages. +

          + +

          Technical security

          Protect sensitive information

          Some messages include sensitive information like security codes or password reset links.

          @@ -46,6 +76,23 @@

        If signing in with a text message is a problem for your team, contact us to find out about using an email link instead.

        + Screenshot of a teat message in review with the link to 'hide personalization after sending' circled. + +

        How to hide PII after sending a message

        + +

        User permissions and signing in

        +

        You can set different user permissions in Notify. This lets you control who in your team has access to certain parts of + the service.

        + +

        Multi-factor authentication (MFA)

        +

        Notify.gov uses Login.gov to authenticate users.

        +
          +
        • Your email address and password
        • +
        • A code from an authenticator app or sent by Login.gov in the form of a text message
        • +
        +

        If signing in with a text message is a problem for your team, contact us to find out about using an email link instead.

        + - + {% endblock %}