Security & Compliance

Every tenant runs in its own dedicated Postgres schema. There is no shared table filtered by a tenant id that a query bug could leak across. Tenant context is resolved on each request and the authenticated token is bound to the tenant, so a token issued for one tenant cannot reach another’s data.

Integration credentials — SMTP/IMAP, WhatsApp, SMS, telephony and e-signature keys — are stored per tenant and encrypted at rest with AES-256-GCM. Non-secret configuration is kept separate from the encrypted secret blob. Secrets are only ever decrypted server-side, at the moment they are used to send, and are returned to the UI masked.

Authentication uses short-lived access tokens with refresh rotation. Every route enforces role-based permissions (owner, admin, member, read-only). Requests are rate-limited to protect shared capacity. Public surfaces (form capture, document signing, booking, tracking) are scoped to exactly what they need and expose no internal identifiers.

Per-contact marketing consent and do-not-contact are enforced at the moment of delivery — an opt-out registered after a message is queued still stops it. This applies across email, WhatsApp and SMS.

Your data is stored in India and handled under the Digital Personal Data Protection Act (DPDP). Marketing consent and opt-outs are enforced on every outbound message and call.

We align our handling of personal data with India’s DPDP Act and, for contacts in Europe, GDPR. Tenant administrators can manage most data directly; export and subject-erasure workflows are being expanded. See our Privacy Policy for detail.

If you believe you have found a security issue, please contact us through your account or our published address before disclosing it publicly, and we will work with you to resolve it.