diff --git a/app/assets/images/product/security-review-message.png b/app/assets/images/product/security-review-message.png new file mode 100644 index 0000000000..ffb59076c8 Binary files /dev/null and b/app/assets/images/product/security-review-message.png differ diff --git a/app/content/get-started.md b/app/content/get-started.md index 7846c0fe66..47757b2c18 100644 --- a/app/content/get-started.md +++ b/app/content/get-started.md @@ -1,43 +1,21 @@ # Get started -1. ## Check if Notify.gov is right for you -

Read about our features, pricing and roadmap.

+1. ## Everyone starts in [Trial Mode](/using-notify/trial-mode) +Explore Notify, add team members, and practice [sending messages to teammates](/using-notify/trial-mode). +2. ## Personalize content +Learn how to [personalize messages](/using-notify/guidance) to increase response. -2. ## Create an account - {% if not current_user.is_authenticated %} -

Create an account for free and add your first Notify service. When you add a new service it will start in trial mode.

- {% else %} -

Create an account for free and add your first Notify service. When you add a new service, it will start in trial mode.

- {% endif %} - -3. ## Write some messages - {% if True %} -

Add message templates with examples of the content you plan to send. You can use our guidance to help you.

- {% endif %} - -4. ## Set up your service - {% if not current_user.is_authenticated or not current_service %} -

Review your settings to add message branding and sender information.

-

Add team members and check their permissions.

- {% else %} -

Review your settings to add message branding and sender information.

-

Add team members and check their permissions.

- {% endif %} +3. ## Check delivery status +[Analyze the delivery](/using-notify/delivery-status) of your messages and download reports +4. ## View messaging limits +Learn about message _parts_ and [how limits are calculated](/using-notify/pricing). 5. ## Start sending messages - {% if not current_user.is_authenticated or not current_service %} -

When you’re ready to send messages to people outside your team, go to the Settings page and select Request to go live. We’ll approve your request within one working day.

- {% else %} -

You should request to go live when you’re ready to send messages to people outside your team. We’ll approve your request within one working day.

- {% endif %} - - +To remove the restrictions of Trial Mode and begin sending messages to clients complete the [Live Campaign Form](https://airtable.com/appe4n7jYOALPLcyU/shrIPWnLTw9U1fclL). +We’ll respond within one business day. - +### Questions? +[Contact the Notify team](/support) diff --git a/app/templates/views/guidance/index.html b/app/templates/views/guidance/index.html index 7d43f81c3f..e754ef245c 100644 --- a/app/templates/views/guidance/index.html +++ b/app/templates/views/guidance/index.html @@ -11,115 +11,229 @@

Guidance

-

This guidance is for teams using Notify.gov to send text messages.

- -

It explains how to:

+

Notify allows you easily to create templates for messages for your recipients. You can customize messages to encourage + your recipient to manage their benefits and increase follow through.

+

Below we explain how to:

-

Edit and format messages

+ {# Format content #} +

Format your content

+

Effective texts will help your message recipients take the steps needed to secure and keep the benefits and services + they depend on. To craft an effective text:

-

This section explains how to:

-

Format your content

- -

You can see a list of formatting instructions on the edit template page:

- -
    -
  1. Go to the {{ service_link(current_service, 'main.choose_template', 'templates') }} page.
  2. -
  3. Add a new template or choose an existing template and select Edit.
  4. +

    To create and format your message

    +
      +
    1. All messages start from a template
    2. +
    3. Click “Send Messages”. You’ll see existing templates.
    4. +
    5. Add a new template or choose an existing template and select Edit.
    - - -

    When composing a text message, write URLs in full and Notify will convert them into links for you. -

    - -

    You cannot convert text into a link. - -

    - -

    We do not recommend using a third-party link shortening service because:

    + {# Add links #} + +

    When composing a text message, links to websites or online applications can help your recipient respond quickly.

    -

    Personalize your content

    - -

    To personalize the content of your messages, add a placeholder to the template.

    - -

    Placeholders are filled in with details, like a name or reference number, each time you send a - message.

    - -

    To add a placeholder to the template:

    - -
      -
    1. Go to the {{ service_link(current_service, 'main.choose_template', 'templates') }} page.
    2. -
    3. Add a new template or choose an existing template and select Edit.
    4. -
    5. Add a placeholder using double brackets. For example: Hello ((first name)), your reference is - ((ref number)).
    6. -
    7. Select Save.
    8. -
    - -

    When you send a message you can either:

    +

    About link-shortening services

    +

    We do not recommend using a third-party link-shortening service because:

    + + {# Personalize content #} +

    Personalize your content

    +

    Personalizing your content can increase response rates and help the recipient know the text is legitimate.

    -

    If you upload a list, the column names need to match the placeholders in your template.

    +

    To personalize your content

    +
      +
    1. Add a placeholder to your content by placing two brackets around the personalized elements.
    2. +
    3. You can manually enter the personalized content or you can upload a spreadsheet with the details and let Notify do the + work for you. See data preparation.
    4. +
    -

    Add optional content

    +

    Example

    +

    To personalize with the recipient's first name and include a reference number:

    +

    State WIC: Hello ((first name)), your reference is ((ref number)). Please provide this number when you call 123-123-1234 to make an appointment.

    -

    To add optional content to your messages:

    + {# Add conditional content #} +

    Add conditional content

    +

    Conditional (or optional) content appears only when a recipient meets certain criteria. This feature allows you to make + all or part of the message contingent upon specific criteria associated with the recipient.

    -
      -
    1. Go to the {{ service_link(current_service, 'main.choose_template', 'templates') }} page.
    2. -
    3. Add a new template or choose an existing template and select Edit.
    4. -
    5. Use double brackets and ?? to define optional content. For example, if you only want to show something to people - who are under 18: ((under18??Please get your application signed by a parent or guardian.))
    6. -
    7. Select Save.
    8. +

      To add conditional content

      +
        +
      1. Use two brackets and ?? to define the conditional content.
      2. +
      3. You can manually enter the conditional content or you can upload a spreadsheet with the personal details and let Notify + do the work for you. See data preparation.
      -

      For each person you send this message to, specify ‘yes’ or ‘no’ to show or hide this content. You - can either:

      +

      Examples

      +
        +
      1. If you only want to show something to people who are under 18: +
        +

        State SNAP: Renewal applications are due by March 15. ((under18??Please get your application signed by a parent or + guardian.))

        +
      2. +
      3. + If you want to make people who are homebound aware of the option of virtual visits (but not other message recipients): +
        +

        State Medicaid: Please call 123-123-1234 to schedule an appointment. ((homebound??Virtual visits are available.))

        +
      4. +
      5. + If you want to send a messages in different languages to different recipients: +
        +

        ((English??We’ve identified unauthorized use on your EBT account. Call the phone number on the back of your card to + cancel or go to your local CSO for immediate replacement.))((Spanish??Hemos identificado un uso no autorizado en su + cuenta EBT. Llame al número de teléfono que aparece en el reverso de su tarjeta para cancelarla o diríjase a su CSO + local para que se la sustituyan inmediatamente.))

        +
      6. +
      - -

      If you upload a list, the column names need to match the optional content in your template.

      + {# Identify your program #} +

      Identify your program

      +

      You can help your recipients identify your texts as legitimate by customizing your messages to clearly state who they + are from. Consider using the program or benefit name that is most familiar to your recipients.

      -

      Message customization

      +

      To customize your program name

      +

      To change the text message sender from the default service name:

      +
        +
      1. Go to the Settings page
      2. +
      3. Select “Start text messages with service name.”
      4. +
      5. Change the service name to a familiar program or benefit.
      6. +
      -

      Change the text message sender

      + {# Prepare your data #} +

      Prepare your data

      +

      The easiest and most efficient way to personalize your content is by uploading a spreadsheet. Notify can accommodate + many file formats and structures.

      -

      The text message sender tells your users who the message is from.

      +

      File format

      +

      Notify can accept files in the following formats: CSV, TSV, ODS, and Microsoft Excel.

      -

      To change the text message sender from the default of ‘Notify.gov’:

      +

      File structure

      + + +

      Formatting personalized content

      +

      If you are sending a message with personalized content, such as the first name of the recipient or the appointment time + and location, the names of the column headings have to match the indicator included in the message template.

      +

      For example, if the personalized content is the first name of the recipient, and we are using the spreadsheet below, the + indicator in the message needs to be ((First name)), not ((firstname)) or ((name)).

      + +

      Formatting conditional content

      +

      If you are sending messages with conditional content, such as content based on the recipient’s preferred language or + location, the flag to receive the content needs to be captured in its own column with a Yes or No (Y/N) flag.

      + +

      Example

      + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      + Example +
      Phone numberFirst nameLast nameSpanishEnglishDateTimeLocation
      123-456-7890LuluPraetherNYNovember 2, 20233:25123 Ford Rd.
      234-567-8901SelaAppelYNNovember 2, 20234:00123 Ford Rd.
      123-456-7890DexterMoseleyNYNovember 2, 20232:00123 Ford Rd.
      + + {# Preventing fraud #} +

      Preventing fraud

      +

      Texting fraud is ever prevalent and while we can’t eliminate the risk, we can reduce the chances that recipients will + fall victim to fraud.

      +
        +
      1. Never send unnecessary or protected private information.
      2. +
      3. Remind your recipients that text messaging is not a secure means of communication and they should not send you private + information via text.
      4. +
      5. Only include links to websites and online applications that are secure.
      6. +
      7. Send an introductory text letting recipients know you will be texting them and to save the number in their phone.
      8. +
      9. Include an auto-response with the name of your organization and a contact phone number.
      10. +
      -
        -
      1. Go to the Text message settings section of the {{ - service_link(current_service, 'main.service_settings', 'settings') }} page.
      2. -
      3. Select Manage on the Text message - senders row.
      4. -
      5. Select Change or Add text message - sender.
      6. +

        Examples

        +
          +
        1. Introductory text: +
          +

          State Transit Dept: We're piloting a new way to get important reminders to our staff. Save this number to your phone, + you'll receive updates from us here.

          +
        2. +
        3. Auto-response text: +
          +

          State Agency: This number is unmonitored. To contact us, call us at 123-123-1234. We will never ask for personal details + in a text. If you have questions about how to protect your privacy, see statename.gov/privacy.

          +
        {% endblock %} diff --git a/app/templates/views/roadmap.html b/app/templates/views/roadmap.html index 0784e693db..6ea2e7cfb2 100644 --- a/app/templates/views/roadmap.html +++ b/app/templates/views/roadmap.html @@ -22,18 +22,22 @@

        Roadmap

        This roadmap is only a guide. It does not cover everything we do, and some things may change.

        You can contact us if you have any questions about the roadmap or suggestions for new features.

        -

        What we’re working on

        +

        What we’re working on

        -

        Now

        +

        Now

        We are investigating the Notify concept, building on the notifications tool pioneered by the UK.

        To do this, we are convening a pilot with a small set of partners.

        Goals during this stage:

          -
        • Achieve compliance to begin piloting, such as ATO and privacy standards
        • -
        • Demonstrate that a government-run notifications tool provides a unique value
        • -
        • Gather data from the pilot to improve the product
        • +
        • Achieve compliance to begin piloting, such as ATO and privacy standards. + +
        • +
        • Demonstrate that a government-run notifications tool provides a unique value.
        • +
        • Gather data from the pilot to improve the product.

        Features prioritized during this stage:

        @@ -46,53 +50,38 @@

        Now

      7. Message send/failure analytics
      8. -

        Next

        + Next

        If the pilot is successful, we hope to recruit additional high-impact partners to improve outcomes for low-income individuals and families.

        Goals during this stage:

          -
        • Complement Notify with practical guidance and support services
        • -
        • Iterate on existing features and implement new features based on what we've learned so far
        • -
        • Hone our measurement approaches to better quantify impact
        • +
        • Complement Notify with practical guidance and support services.
        • +
        • Iterate on existing features and implement new features based on what we've learned so far.
        • +
        • Hone our measurement approaches to better quantify impact.

        Features prioritized during this stage:

        -
          +
          • SMS sending via API integration
          • -
          • Single-level decision two-way messaging (e.g. reply “YES” if, or “NO” if…)
          • Self-service account creation
          • Application status page
          • -
          • Scheduled send option
          • +
          • Improved scheduled send option
          -

          Later

          +

          Later

          In the future, we may decide to expand beyond SMS, or to offer the service government-wide.

          Features to be considered during this stage:

          -
            +
              -
            • Email sending via UI and API
            • -
            • Multiple-level decision two-way messaging (greater than one layer decision-tree)
            • -
            • Open-text reply two-way messaging (rather than reply yes or no, 1 or 2, etc.)
            • +
            • Two-way messaging
            • Multilingual interface and content library options
            • Recurring scheduled send (such as “Send each Monday for 3 weeks”)
            • -
            - - {% endblock %} diff --git a/app/templates/views/security.html b/app/templates/views/security.html index f55ad3de58..d676b37bf9 100644 --- a/app/templates/views/security.html +++ b/app/templates/views/security.html @@ -15,22 +15,52 @@

            Security

          • manage risks around information
          -

          Data

          -

          On Notify, data is encrypted:

          -
            -
          • when it passes through the service
          • -
          • when it’s stored on the service
          • +

            Infrastructure

            + +

            Notify.gov is comprised of two applications both running on cloud.gov:

            +
              +
            • Admin, a Flask website running on the python_buildpack which hosts agency user-facing UI
            • +
            • API, a Flask application running on the python_buildpack hosting the Notify API
            -

            Any recipient data you upload is only held for seven days.

            - -

            Technical security

            - +

            Notify.gov utilizes several cloud.gov-provided services through Amazon Web Services (AWS):

            +
              +
            • AWS S3 buckets for temporary file storage
            • +
            • AWS Elasticache (Redis) for caching data and enqueueing background tasks
            • +
            • AWS RDS (PostgreSQL) for system data storage
            • +
            + +

            Notify.gov also provisions and uses two AWS services via a supplemental service broker:

            +
              +
            • AWS SNS for sending SMS messages
            • +
            • AWS SES for sending email messages (note: email function is currently unavailable to users for pilot)
            • +
            + +

            Current security review

            +

            Currently, Notify.gov operates under a GSA Lightweight Authority to Operate (LATO). This federal security authorization + process leverages security controls provided by National Institute of Standards and Technology (NIST). The process is + focused on operational security from both a functional and assurance perspective.

            +

            We are pursuing a full Authority to Operate (ATO)

            + +

            Data

            +

            To send a message, agencies upload a spreadsheet of phone numbers and other necessary data from their existing data + management system. On Notify.gov, data is encrypted when it passes through the service and when it’s stored on the + service.

            +

            Notify.gov is not a system of record and as a result does not have a SORN. Agencies are responsible for managing their + data outside of Notify.gov.

            +
              +
            • Notify stores data within the cloud.gov-managed PostgreSQL database and S3 buckets. The entire database is encrypted at + the disk level.
            • +
            • Additionally, data is encrypted at the field level when it is stored in the database, using OpenSSL 3.0.8 via the Python + cryptography library. The implementation is available on GitHub.
            • +
            + +

            Data retention

            +

            Any recipient data uploaded is only held for seven days; all personally identifiable information (PII) is deleted for + successful messages, so data is retained only for unsuccessful messages. +

            + +

            Technical security

            Protect sensitive information

            Some messages include sensitive information like security codes or password reset links.

            @@ -46,6 +76,23 @@

            Two-factor authentication

          If signing in with a text message is a problem for your team, contact us to find out about using an email link instead.

          + Screenshot of a teat message in review with the link to 'hide personalization after sending' circled. + +

          How to hide PII after sending a message

          + +

          User permissions and signing in

          +

          You can set different user permissions in Notify. This lets you control who in your team has access to certain parts of + the service.

          + +

          Multi-factor authentication (MFA)

          +

          Notify.gov uses Login.gov to authenticate users.

          +
            +
          • Your email address and password
          • +
          • A code from an authenticator app or sent by Login.gov in the form of a text message
          • +
          +

          If signing in with a text message is a problem for your team, contact us to find out about using an email link instead.

          + - - + + {% endblock %}