What protects your data, and what we do not claim.

✓What we do

• Message content is encrypted with a key per account

  Bodies are sealed before they are stored, under a key derived per account and contact, so a database copy without the key material is not readable. Reads go through one decision point, which is why an unreadable message is reported as unreadable rather than rendered blank.

• Credentials are never stored in the application database

  Meta access tokens and webhook signing secrets are sealed through a separate credential broker and resolved at the moment of use. The services that send messages hold them for the length of one request.

• Every tenant is isolated in the database itself

  Row-level security is applied per table rather than trusted to application code, so a query that forgot its account scope returns nothing instead of someone else's data.

• The audit trail is tamper-evident

  Changes to users, roles, API keys, webhooks, privacy requests, retention and legal holds are recorded with their actor and reason, and each entry hashes its predecessor, so a removed or rewritten entry breaks the chain. Not every change is audited yet — parts of contact, consent and media handling are still being added — and we say so rather than imply otherwise.

• Consent and opt-outs are enforced, not just recorded

  A marketing send without recorded consent is refused before it leaves. An opt-out reply stops marketing automatically — STOP and its equivalents in English, French, Spanish, Portuguese and Arabic, whatever the capitalisation or punctuation, plus keywords you add — and the person gets a confirmation. The suppression register is append-only: lifting a suppression is a recorded change, never a deletion.

• Webhooks are signed, and outbound calls are constrained

  Deliveries to your endpoint are signed so you can verify they came from us, with rotation and an overlap window. Outbound requests go through an egress guard so a webhook URL cannot be used to reach internal addresses.

• Uploads are scanned before they are usable

  Media is scanned for malware and held until it passes. A file that fails never becomes sendable.

• Your compliance team can place its own legal holds

  Owners, admins and the Compliance manager role can put a hold on the whole account, a contact or a conversation from the console. While it stands, retention keeps everything in scope and erasure requests that touch it are parked with a message saying why. Placing and releasing a hold is audited, and releasing one needs a step-up.

• Data deletion is a tracked operation with evidence

  Access, portability and erasure requests run as operations you can follow, and finish with a record of what was exported or erased. Message content and records are kept until you delete them or set a retention period of 30 days to 10 years; an hourly job applies the period you set.