Security
Your data is yours. Period.
On this page we describe what we actually do and, where possible, how you can check it.
Every new consent is signed, and anyone can check it
Every new consent is signed with an Ed25519 key, and its public half is published. The signature proves that the consent data has not changed since it was signed. Whoever holds a proof file can check it on the verification page, with no account, or offline, by comparing the public keys inside the file with the published ones.
Each customer's data is kept separate
The database enforces row-level rules on every table that holds customer data. The server, which works with administrative access, checks in the code which customer each request belongs to, and an automated test on the code flags writes that do not declare it.
When we open your account
Whoever administers the platform can open a customer's area to give support, and only with the second factor: for that role two-step sign-in is mandatory, and without the code from the authenticator app the panel does not open. Every time we open a customer's area from the panel (picking it ourselves, at sign-in, or by opening one of its pages or data downloads) the opening is recorded before the data shows: who, which customer and when. If the record cannot be written, the area does not open; and at every new sign-in to the panel the opening is recorded again. People who run the infrastructure can also access the database directly, for maintenance and restore.
No conflict
We do not analyse your lists for our own purposes. It is a commitment, not a technical lock: the Terms name us data processor (Art. 28 GDPR), and you are the controller of your contacts' data.
What happens to a consent, from yes to withdrawal
The yes is confirmed with a code
Every consent collected through the form is confirmed with a code. Since 28 September 2026 the consent covers only the address that received the code, and the confirmation is signed too.
Withdrawal is signed, with a code to quote
Every withdrawal is signed like the consent and has its own REV code to quote as proof: whoever withdraws from the link sees it on screen straight away.
The register only grows at the end
Every signed consent goes into a register that only grows at the end: a row already written is not rewritten. The signature says that row has not been touched. The daily root that closes the register is not switched on yet.
A STOP turns off one channel, not everything
On WhatsApp, whoever sends STOP stops receiving on WhatsApp from that business; the other channels they chose stay on. For email and text messages, people opt out through the link in every message. Every STOP is added to the register as a new fact.
When in doubt, nothing is sent
If the list of people who opted out cannot be read, the send stops instead of going out blind.
Withdrawing from the link removes personal data from the consent record
When someone withdraws from the link, we erase their name, contact details, IP address and browser data from their record, after recording the check of their consent's signature. Encrypted backup copies keep them until those copies expire, and we keep only what is needed not to write to them again.
Where the data lives and how it is protected
European data centres
The application's functions run in Frankfurt; the database, email and archives are in Ireland. Other providers receive data for specific functions, AI included: the privacy notice lists them in § 5, and transfers outside the European Economic Area are described in § 7.
Security headers on every page
Every page answers with HSTS (with the preload directive), nosniff, frame-ancestors, Referrer-Policy, Permissions-Policy and upgrade-insecure-requests.
Shared rate limits
Limits on codes, forms, sign-up and AI features apply across all server instances together. If the counter fails, an action that spends something (a text message, a credit) stops; withdrawing or checking a proof file goes through, by design.
Encrypted daily copy
A copy of the database is scheduled every night, encrypted and uploaded to S3 in Europe under Object Lock. Restore was tested on 8 October 2026, and we plan to repeat it every month.
Errors filtered before they leave
Technical errors go to our monitoring, in a European region, after a filter that strips IP addresses, emails, phone numbers and headers; an event that cannot be cleaned is dropped. It is an automatic filter: data written in a form it does not recognise can remain.
The list of providers that receive data is in the privacy notice, § 5; transfers outside the European Economic Area, § 7: open the privacy notice.
Ready to start
Your brand deserves a flawless channel
Tell us how you work and sign a real consent on the application page. We review every business: access comes only with an invitation. You can try the demo in the meantime.