Security

• • In transit — TLS 1.2+ enforced on every edge and internal hop. HSTS is preload-listed.
• • At rest — AES-256-GCM for databases, object storage, and backups. Keys managed by AWS KMS.
• • Field-level encryption — Provider credentials, webhook signing secrets, and PII fields (phone, email) are envelope-encrypted with per-tenant data keys.
• • Key rotation — Master keys rotate automatically every 90 days. Data keys rotate on read for hot rows.
• • Message content retention — Configurable per workspace between 30 days and 7 years. Attachments are encrypted with unique per-object keys.

• • Immutable audit log — Every state change (auth, config, provisioning, data access) is appended to a tamper-evident hash chain.
• • Merkle root export — Daily Merkle root published to allow you to prove non-tampering after the fact.
• • SIEM webhook feed — Real-time firehose of security events to your SIEM (Splunk, Datadog, ELK).
• • API access logs — Retained 400 days, downloadable via GET /v1/audit.

Choose the region your data lives in at workspace creation. Regional isolation is enforced at the storage, compute, and backup layer.

• • Never commit API keys to source control — use a secret manager or CI/CD variables.
• • Prefer restricted keys for edge services — grant only the resources you need.
• • Rotate keys quarterly. Revoke immediately on any suspected leak.
• • Verify webhook signatures before parsing the body — treat unsigned requests as hostile.
• • Enforce IP allowlists on production keys where your infra has stable egress.