Security

Security is central to a platform that carries customer conversations. This page describes the measures ReMessage applies to ReMessage.

Encryption

• All traffic between your browser and our servers is encrypted with TLS (HTTPS).
• WhatsApp access tokens and AI provider API keys are encrypted at rest with AES-256-GCM before being written to the database. They are never returned to the browser and never logged.
• Passwords are hashed with bcrypt and are not recoverable, even by us.

Access control

• Every workspace is logically isolated. Each database query is scoped to the signed-in user's workspace, so one customer can never read another customer's data.
• Role based access within a workspace: Owner, Admin, Agent and Viewer, each with a different level of permission.
• Sessions use signed, HTTP-only cookies that cannot be read by browser scripts.
• API keys are stored only as hashes, can be scoped, and can be revoked at any time.
• Access to production infrastructure is limited to authorised personnel and protected by strong authentication.

Integrity of incoming data

• Every webhook from Meta is verified with an HMAC-SHA256 signature against our app secret before it is processed. Unsigned or mismatched requests are rejected.
• Outgoing webhooks we send to customer endpoints are signed so the receiver can verify authenticity.
• Webhook payloads are queued and processed asynchronously, so a malformed request cannot disrupt live traffic.

Infrastructure

• Hosted with DigitalOcean, LLC (United States) — Cloud server hosting and database storage. The provider maintains physical and network security for the underlying data centres.
• Databases are not exposed publicly without authentication, and credentials are rotated when staff access changes.
• Automated backups are taken regularly and rotate within 35 days.

Application safeguards

• Input is validated on the server for every API route and form.
• Rate limiting is applied to public API endpoints and to message sending, respecting Meta's per-number limits.
• Sensitive actions such as connecting a number, changing roles and exporting data are recorded in an audit log.
• Dependencies are kept up to date and the codebase is type-checked in continuous integration.

Data minimisation

We collect only what the service needs to function. We do not sell data, we do not use customer conversations to train models, and we do not use data received from Meta for advertising. Retention periods are set out in our Privacy Policy.

Incident response

If we become aware of a personal data breach that is likely to result in a risk to individuals, we will notify affected customers without undue delay and, where required, within 72 hours of becoming aware, together with the relevant supervisory authority.

Reporting a vulnerability

If you believe you have found a security issue, email remessage@gmail.com with the subject “Security report” and enough detail to reproduce it. Please give us reasonable time to fix the issue before disclosing it publicly. We do not take legal action against researchers who act in good faith and do not access or modify other people's data.

Contact

ReMessage
TODO: Street, City, State, PIN, India
Email: remessage@gmail.com