Security

• Every account's customers, campaigns, messages, revenue and billing data are isolated and checked on every request.
• Passwords are stored with the scrypt key-derivation function; sessions use secure, HTTP-only cookies and CSRF protection.
• All traffic is encrypted in transit (HTTPS). Integration credentials, such as Square access tokens, are encrypted by the application (AES-256-GCM) before they are stored.
• Webhooks from billing, email and SMS providers are signature-verified and processed exactly once.
• Sign-in, import, messaging and public endpoints are rate-limited.
• Material account, billing and campaign changes are recorded in an audit log you can review.
• Unsubscribes, bounces and SMS STOP replies are enforced automatically and permanently.

We do not currently hold third-party security certifications. Report a security concern to support@wincustomersback.com.