Security

• Each business's customers, campaigns, messages, revenue, billing and team are isolated, and access is checked on every request.
• Team roles control what people can do: owners and admins manage billing, team members and API keys; members cannot.
• Passwords are stored with the scrypt key-derivation function. Sign-in sessions, email confirmation, password reset and invitation links, and API keys are random tokens stored only as one-way hashes; links expire and work once.
• Sessions use secure, HTTP-only cookies, and every form is protected against cross-site request forgery.
• All traffic is encrypted in transit with TLS 1.2 or newer. Integration credentials, such as Square access tokens, are encrypted by the application (AES-256-GCM) before they are stored, and provider keys are kept as encrypted secrets on our hosting platform, never in our code.
• Webhooks from billing, email and SMS providers are signature-verified, and repeated deliveries are recognised so they have no additional effect.
• Sign-in, sign-up, password reset, import uploads, invitations and public forms are rate-limited, and outgoing messages are capped per business each day.
• Production and test environments use separate databases and credentials. The production database is a managed PostgreSQL service with automated backups and point-in-time restore.
• The service exposes health and readiness checks and tracks its background worker's heartbeat, and important account, billing and campaign changes are recorded in an audit log you can review.
• Unsubscribes, bounces and spam complaints (and, when SMS is enabled, STOP replies) are enforced automatically.

No system can be guaranteed completely secure, and we do not currently hold third-party security certifications. Report a security concern to support@wincustomersback.com.