Trust centre
What we do to protect your account, your messages and your recipients' data — described as the platform actually works, with a link to the document that governs it.
Updated 22 October 2026
Platform security
- API keys: stored only as a hash (SHA-256), shown once at creation, limited by permission scopes (send, status, balance, OTP…), with an optional IP allowlist and sandbox keys that send and bill nothing.
- Dashboard: two-factor authentication (TOTP) and passkeys; changing your password revokes your other sessions; sessions are listed and revocable in settings.
- Webhooks: every delivery is signed with HMAC-SHA256 over a timestamp (replay protection) and a per-destination secret you can rotate; destinations must be public HTTPS URLs, checked again at every redirect.
- OTP codes: kept only as a hash, with a limited validity.
- Internal access: separate roles (owner, support); every administrative action is logged with who did it.
- Anti-phishing: messages impersonating a bank or institution, and sender names imitating one, are refused before anything is sent.
- Transport: HTTPS only, with HSTS (preloaded).
Data location
- The platform is hosted on Cloudflare's edge infrastructure, delivered as close to Morocco as possible. The per-provider detail is in the sub-processor list and the legal notice.
- Data is encrypted in transit and at rest.
Retention
- Routing logs and delivery receipts: 30 to 90 rolling days, then purged or irreversibly anonymised.
- WhatsApp media: 12 months, then deleted automatically.
- Account data: deleted or anonymised within 30 days of closure, except where accounting law requires otherwise. Export and erasure requests are self-service in settings ("My data").
Backups and continuity
- Point-in-time restore of the database over the last 30 days.
- A full logical backup every night to separate object storage, kept for 35 days.
- Service state is published on the status page.
Sub-processors and data processing agreement (DPA)
- The full list of sub-processors, their role and the data involved is published and kept current.
- The DPA sets out our commitments as a processor, including notification of a personal data breach within 72 hours.
Report a vulnerability
- Write to security@envoisms.ma. Our security.txt file gives the contact and disclosure policy.
- If you think an API key is exposed, revoke it and create a new one in the dashboard, then let us know.
Independent assessments
- We do not yet hold a third-party certification or audit report. When an external assessment is completed, its summary will be published here.