Security overview
Only verified or implementation-ready capabilities appear here. SendiMessage does not currently claim third-party certifications — anything planned is labeled as planned.
Credentials
- API keys are stored hashed — plaintext keys are shown once at creation and never again
- Test and live keys are separated; test traffic cannot touch production lines
- Credential rotation is supported per key
- Secure onboarding links deliver initial credentials without email exposure
Integrity and reliability
- Webhooks are signed — verify the signature header before trusting any event
- Idempotency prevents duplicate sends across retries
- Non-2xx errors use a stable, documented error envelope
Access and audit
- Restricted internal access to customer configuration
- Audit logging records administrative and lifecycle actions
- Log redaction keeps message content out of operational logs
Transport
- All API and webhook traffic is encrypted in transit (HTTPS/TLS)
Certifications
SendiMessage does not currently hold formal security certifications and does not claim any. If your review requires specific attestations, raise it in a security review — planned items are discussed honestly there.