Every claim on this page is one you can ask us to demonstrate, and the things we have not built yet are listed here too. We hold no security certification, we publish no uptime figure, and we would rather tell you that than let you find out during a review.
No adjectives, no badges. Each of these is a mechanism you can ask us to walk you through, line by line, on a call with your own engineer listening.
Every table that holds your records carries the brand it belongs to, and the database itself refuses to hand back anything that does not match the brand you are signed in to. That rule sits in the database, not only in our application code, so a badly written query still comes back empty rather than full of someone else’s customers. Which brand you are is decided by your signed-in session and can never be set by a value sent from a browser.
Your contacts’ email addresses, phone numbers and names are stored encrypted, under a key derived separately for each brand. So are the credentials you hand us: your outgoing mail password, your SMS provider keys, your WhatsApp tokens and any connected account. Traffic to the site runs over HTTPS with a certificate that renews itself.
Every action that changes something is recorded: the person or key that did it, what was touched, what it looked like before and after, the time, the network address and the browser. Entries are only ever added by the product, never edited. They are kept indefinitely and are not swept up by the routine clean-up.
When a customer record is erased it is genuinely removed, along with that person’s message history, their activity trail and their consent records, in one operation that either completes fully or changes nothing. It is not a hidden flag and there is no undo. What survives on purpose is the note in the change record saying the deletion happened.
Turn on a second step and sign-in needs a code from an authenticator app, backed by ten single-use recovery codes. Five wrong passwords locks the account, and each further round doubles the wait up to a day. Sign-in attempts are rate-limited. You can see every active session with its device and network address, end any one of them, or sign out everywhere.
Message content is scanned before it goes out and blocked past a threshold. Daily and hourly ceilings start low on a new account and rise as it builds a record. If bounces pass 5 in 100, complaints pass 5 in 10,000, or volume jumps more than fivefold in a day, sending freezes automatically — with a warning at three quarters of each line.
This is the question a reviewer asks first and the one most products answer vaguely. Here is the actual sequence.
Tell us the brand and how to identify the person — an email address or a phone number is enough. Deletion is not a button in your account today; it is a request our team runs, which also means nobody who gets hold of a login can wipe your records.
The contact row, that person’s messages, their activity history and their recorded consents are removed together. If any part fails, none of it happens — you never end up with half a person left behind.
Anything hanging off that contact goes with it: their conversations, their loyalty account, their consent trail. A few records that merely mention them, such as a form submission, are kept with the link to the person cut instead.
A line goes into the change record naming what was removed and why, so you can show a reviewer that the request was carried out. The delivery record for messages already sent to that person is also kept, because it is the evidence that you sent what you say you sent.
Separately, routine clean-up runs every night against fixed limits: message history is kept for a year, contact activity for six months, automation runs for three months, and delivery attempts and sign-in sessions for a month. Those limits apply across the platform — they are not per-account settings yet.
A security page that only lists strengths tells you nothing, because every security page lists strengths. The rows with a dash are the useful half.
| In place | What that means in practice | |
|---|---|---|
| Brand separation enforced by the database | Yes | The rule lives in the database, so an application bug still cannot return another brand’s rows. |
| Contact details and channel credentials encrypted | Yes | Names, emails, phone numbers, your mail password and your provider keys, each brand under its own derived key. |
| Record of every change-making action | Yes | Actor, action, before and after, time, network address, browser. Kept indefinitely. |
| Second step at sign-in | Yes | Authenticator app plus ten single-use recovery codes, per person. |
| Session list and remote sign-out | Yes | See each active session with its device and address; end one or all of them. |
| Scoped, revocable API keys | Yes | Shown once, stored scrambled, limited to chosen permissions and optionally to set addresses. |
| Custom roles for your team | Yes | Forty-four separate permissions, four ready-made roles, and you cannot grant a teammate more than you hold yourself. |
| Make the second step mandatory for your whole team | No | Not yet. Each person turns it on for themselves; an owner cannot force it account-wide. |
| Read your own change record inside the product | No | Not yet. The record exists and is complete — ask us and we will extract your account’s. |
| Delete a customer yourself, from the screen | No | Not yet. Send the request and our team runs it. |
| Sign-in through your company identity provider | No | Not available. Email and password, or Google, Facebook, GitHub or X. |
| Independent security certification | No | We hold none. We will not imply otherwise, and we will answer your questionnaire in writing instead. |
| Published uptime or delivery guarantee | No | We publish neither, because we do not yet measure them in a way we would accept being held to. |
| Public status page | No | Not yet. Incidents affecting your account are emailed to the admins on it. |
| Separation test run automatically on every release | No | The test exists and asserts that one brand reads none of another’s rows — but we run it by hand. It does not gate a release yet. |
If you are reviewing us on behalf of a clinic, a school, a lender or a client’s brand, this is the material that usually settles it.
No. We hold no independent security certification of any kind, and we are not going to phrase that as "certification-ready" to make it sound better. What we will do is answer your questionnaire in writing, name the person who answered it, and walk your technical reviewer through any mechanism described on this page.
Every table holding your records carries the brand it belongs to, and the database refuses to return rows belonging to any other brand. That check runs inside the database rather than only in our code, which means a mistake in a query returns nothing instead of returning someone else’s customers. Which brand you are counts as is taken from your signed-in session and cannot be set by anything the browser sends. A small number of endpoints rely on the application to filter instead, and we will tell you which if you ask.
The contact record is deleted outright, together with that person’s message history, activity trail and consent records, as a single all-or-nothing operation. It is not a soft delete and it cannot be undone. Records that only reference the person, such as a form submission, are kept with the link cut. A note that the deletion happened goes into the change record, and the delivery record for messages already sent to them is retained. Today this is a request you send us rather than a button in your account.
Bring your questionnaire, your reviewer and your worst-case scenario. We would rather lose the deal on an honest answer than win it on a vague one.
CyberCraft BangladeshQuickGrow AIRun every channel from one platform. Bring your own SMTP, SMS gateway, and WhatsApp number — or use ours.
See pricing →