Trust & Security Center
Zero-Trust architecture, rigorous regulatory alignment, and total transparency. Engineered to satisfy the strictest criteria of CISOs, banks (Bank Al-Maghrib), insurers (ACAPS), and government ministries.
Our 5 Core Enterprise Security Guarantees
Moroccan & International Regulatory Alignment Matrix
Full compliance with regulations from Bank Al-Maghrib, DGSSI (Law 05-20), CNDP (Law 09-08), ANRT, and global ISO/IEC benchmarks.
Banking institutions, credit organizations & outsourced cloud providers
- Directive 3/W/16: Online banking channel hardening, OTP anti-fraud shield, and end-to-end operation tracing.
- Directive 4/W/2022: Framework for outsourced activities, full audit rights for BAM and designated external auditors.
- Contractual 99.95% SLA, RTO < 15 min, RPO < 5 min, and zero-cost data reversibility commitments.
- Zero-Knowledge OTP: Immediate edge SHA-256 hashing; zero plaintext banking credentials persisted at rest.
Critical National Infrastructure (IIV) & Public Sector Entities
- Formal security incident notification within 2 business hours (CERT-DGSSI / maCERT).
- Strict network fencing, hardened API gateways, and continuous intrusion detection.
- Mandatory TLS 1.3 encryption, 2-year HSTS Preload, and strict permissions policy.
- Daily immutable encrypted backups with 30-day point-in-time recovery and tested DRP.
Personal data protection and cross-border data transfer compliance in Morocco
- Zero-Payload Persistence Architecture: minimal retention and automated TTL purging (30 to 90 rolling days).
- Systematic masking of sensitive message bodies and banking OTPs at ingestion (******).
- Ephemeral edge computing without persisting non-essential personally identifiable information.
- Self-service personal data access, export, and deletion rights via API and dashboard.
Direct national SMS routing, Sender ID governance, and anti-spoofing enforcement
- Strict Anti-Spoofing Screening: mandatory KYB validation (RC, ICE, Tax ID, LOA Authorization Letter).
- National Brand Protection: strict blacklists barring unauthorized impersonation of banks and state bodies.
- Local carrier routing to Maroc Telecom, Orange, and Inwi without grey SIM-box routes.
- Automated regulatory STOP SMS opt-out handling for marketing campaigns.
Information Security Management System (ISMS) & Tier-1 Cloud Infrastructure
- Comprehensive Statement of Applicability (SoA) covering all 93 controls of Annex A (2022 edition).
- Cloudflare Edge and datacenter physical infrastructure audited SOC 2 Type II and ISO 27001 / ISO 27701 certified.
- Automated CI/CD DevSecOps compliance scanning with immutable audit evidence preservation.
- Supplier Declaration of Conformity (ISO/IEC 17050-1) prepared for IAF MLA accredited certification audit for VEXT AI SARL AU.
Automotive Digital Suppliers & Telecommunications (OEMs & Tier-1 Suppliers)
- Formal Scope Demarcation Memo excluding prototype CAD data (TISAX AL3 strictly non-applicable).
- Comprehensive VDA ISA v6.0 catalog mapping to compliant ISO/IEC 27001:2022 ISMS.
- Zero-Payload Persistence architecture with source masking of credentials and verification OTPs.
- Ready for remote desk audit under AL2 on the ENX portal (Participant ID PRT-2026-MA-001).
Technical Zero-Trust Architecture & Resilience
How our cryptographic mechanisms and isolation models ensure the uncompromising safety of your enterprise communications.
Compare-And-Swap (CAS) Atomic Transaction Safety
- Every balance debit and outbound message dispatch runs as an atomic CAS mutation at the database engine level.
- Mathematical guarantee against negative balances or concurrency race conditions, even during high-volume API bursts.
- Immutable ledger audit trails recording unique transactional IDs for accounting reconciliation.
SHA-256 Cryptographic API Key Hashing
- API keys are cryptographically generated and presented only once to the developer.
- The database persists exclusively the SHA-256 digest (`key_hash`). Even a full database dump reveals zero plaintext credentials.
- Granular permissions scopes (sms:send, otp:verify, dlr:read) and optional IP CIDR allowlists prevent unauthorized access.
HMAC-SHA256 Webhook Signatures & Replay Prevention
- Every webhook sent to your endpoint carries an HMAC-SHA256 signature calculated with a per-endpoint rotating secret.
- Signature incorporates a millisecond timestamp (`t=...,v1=...`) neutralizing network replay attacks.
- Single-click signature secret rotation in the dashboard with transition grace period support.
Anti-SSRF Protection & Multi-Tenant Isolation
- All outbound webhook deliveries pass through a hardened DNS resolver blocking private IP ranges (RFC 1918), loopbacks, and cloud metadata.
- HTTP redirect validation: every redirect hop is re-evaluated before establishing a connection.
- Multi-tenant database queries enforce tenant scoping on every operation, eliminating cross-account leakage.
Zero-Payload Persistence & Data Minimization (Law 09-08)
- SMS message bodies and delivery logs are automatically purged or irreversibly anonymized after 30 to 90 rolling days.
- OTP verification codes reside exclusively as cryptographic hashes in ephemeral distributed KV memory with 300s TTL.
- Self-service personal data export and erasure compliant with CNDP and GDPR standards.
Compliance Dossier & Downloadable Audit Reports
Download executive audit summaries and compliance dossiers prepared for your vendor security review.
ISMS ISO/IEC 27001:2022 Attestation of Conformity (ISO/IEC 17050-1)
Formal ISMS Declaration of Conformity under ISO/IEC 17050-1 and IAF MLA accredited audit roadmap for operator VEXT AI SARL AU.
TISAX VDA ISA 6.0 Scope Demarcation & Automotive Alignment Memo
Legal and technical justification of AL3 non-applicability and VDA ISA 6.0 / ISO 27001 concordance matrix for automotive OEMs and Tier-1 suppliers.
Security Assurance Plan (PAS) — Enterprise & Banking Standard
Comprehensive framework detailing technical architecture, DGSSI Law 05-20 alignment, BAM 4/W/2022 commitments, DRP/BCP, and vulnerability policies.
ISO/IEC 27001:2022 Statement of Applicability (SoA)
Detailed matrix presenting the implementation and technical justifications for all 93 Annex A controls (2022 edition) and certification roadmap.
External Penetration Test Report (OWASP WSTG v4.2)
Executive penetration testing summary assessing edge perimeter and REST APIs against OWASP ASVS v4.0 and BAM 3/W/16. Findings: 0 critical, 0 high.
Bank Al-Maghrib Compliance Annex (Directive 4/W/2022)
Strict contractual commitments: BAM audit rights, incident notification < 2h, RTO < 15m, RPO < 5m, and full reversibility guarantees.
Automated Pentest & Security Audit Suite (CI/CD Pipeline)
Executable bash test suite automatically asserting security headers, anti-SSRF, OTP hashing, CAS atomicity, and RFC 9116 security.txt in CI/CD.
Infrastructure ISO 27001 & SOC 2 Certificates
Official SOC 2 Type II audit reports and ISO/IEC 27001 certificates for Cloudflare Edge network and physical datacenters hosting EnvoiSMS.
Frequently Asked Questions by CISOs & IT Teams
How does EnvoiSMS address TISAX and automotive industry requirements?
EnvoiSMS provides a formal Scope Demarcation Memo under VDA ISA v6.0 / ENX guidelines: operating exclusively as a public CPaaS transit gateway and OTP processor without storing vehicle telematics, CAD, or prototypes, TISAX AL3 is non-applicable. Information security for plant notifications and operational OTP is guaranteed by our ISO/IEC 27001:2022 compliance (SoA under ISO/IEC 17050-1), certified hosting infrastructure, Bank Al-Maghrib 4/W/2022 annex, and complete documentation ready for TISAX AL2.
What is EnvoiSMS's exact stance regarding ISO 27001?
EnvoiSMS.ma is operated by VEXT AI SARL AU (ICE 004061591000005) with an ISMS compliant with all 93 controls of Annex A (ISO/IEC 27001:2022), documented in our Statement of Applicability (SoA under ISO/IEC 17050-1) and continuously audited via our DevSecOps compliance engine. Physical edge and datacenter infrastructure is hosted on ISO 27001 certified and SOC 2 Type II audited facilities.
How do you address Bank Al-Maghrib requirements (Directives 3/W/16 and 4/W/2022)?
EnvoiSMS provides a dedicated Bank Al-Maghrib Compliance Annex guaranteeing comprehensive audit rights for BAM and authorized bank auditors, 99.95% SLA, RTO < 15 min, RPO < 5 min, incident notification within 2 hours, and zero-cost full data reversibility.
How is personal data protected under Moroccan Law 09-08 (CNDP)?
Our platform enforces a Zero-Payload Persistence architecture. Sensitive message bodies containing OTPs are masked at ingestion (******). Transit logs are purged after 30 to 90 days. OTP codes are never persisted in plaintext (SHA-256 hashed with strict 300s TTL).
What is the vulnerability disclosure procedure?
We maintain an RFC 9116 compliant security.txt file at /.well-known/security.txt. Security reports can be emailed to security@envoisms.ma. We acknowledge receipt within 24 business hours and coordinate fixes following responsible disclosure standards.
How do you guarantee high availability and DDoS resilience?
The EnvoiSMS gateway operates across Cloudflare's global Anycast edge network with real-time DDoS mitigation, automated failovers, and no single point of failure. Backups are performed nightly with a 30-day point-in-time recovery window.
Report a Vulnerability or Request a Security Review
Our security team is available to assist with enterprise RFP security questionnaires and third-party vendor audits.