Security

The platform runs on DigitalOcean infrastructure in Bengaluru, India. Customer data is stored in the data region chosen at signup and is not replicated outside it.

• All traffic to the website, console, API and SDK endpoints uses TLS 1.2 or later.
• Stored data and backups are encrypted at rest by the infrastructure provider.
• Channel Provider credentials (API keys, push certificates, SMTP passwords) are envelope-encrypted with a separate key before they are stored, and are never shown again in full after you save them.
• Passwords are stored only as salted, slow hashes.

• Two-factor authentication for console users.
• Role-based access with separate permissions for Test and Live environments, so people can build in Test without touching production audiences.
• Personal identifiers such as email addresses and phone numbers are masked in the console by default. Revealing them requires a specific permission and is recorded in an audit log.
• Changes moving from Test to Live go through promotion gates you configure.
• Workspaces and environments are isolated from each other at the data layer.
• Staff access to production is limited to named engineers, protected by strong authentication, and logged.

• Application and access logs are kept for at least 180 days in India, as CERT-In directions require, and system clocks are synchronised to a standard time source.
• Automated alerts on error rates, delivery failures and unusual access.
• Daily database backups with periodic restore tests.
• Dependencies are tracked and patched; changes are code-reviewed and deployed through an automated pipeline.

We maintain an incident response process covering detection, containment, investigation, recovery and review. We report cyber incidents to CERT-In within six hours of noticing them where its directions require, notify affected customers without undue delay and in any case within 24 hours of confirming a personal data breach, and support them in notifying the Data Protection Board of India.

Everyone with access to customer data signs confidentiality obligations, receives security and privacy training when they join and every year, and loses access the day they leave.

If you find a security issue, please tell us privately under our Responsible Disclosure policy.