Security

Overview

Tenant membership and suspension are checked server-side. Integration secrets are encrypted; sessions are host-only and redirects are allowlisted. Custom outbound requests validate DNS, pinned connections and every redirect, with timeout and response-size limits.

Setup & requirements

Campaigns, SMS and WhatsApp require explicit policy and approvals. No arbitrary remote MCP server is proxied. Security and provider acceptance gates remain visible in the status page; a healthy HTTP endpoint is not evidence of delivery.

Usage & verification

Custom requests reject unsupported schemes, URL credentials, private/link-local/metadata destinations and unsafe methods. Connections use validated DNS addresses and every redirect is revalidated. Responses, redirects and deadlines are bounded. Provider errors are sanitized before storage or response.

External integrations cannot change policy. Revocation clears local secrets before attempting remote revocation. A remote outage does not reactivate the connection. Plan enforcement currently uses private-beta entitlements; payment/billing synchronization is not claimed.