SendiMessage Trust Center

API authentication

The full secret is displayed a single time at issuance. We store only a one-way hash — the secret is not retrievable afterwards, by you or by us. Secrets are compared with constant-time equality, not string comparison.

Webhook signatures

Every webhook delivery is signed with HMAC-SHA256 of "{timestamp}.{raw request body}" (lowercase hex), keyed with your webhook secret. Verify against the exact raw bytes received — re-serialized JSON differs. Compare using constant-time equality, and reject a timestamp older than a few minutes (replay protection). The official SDKs ship a verification helper (verifyWebhookSignature).

Tenant isolation

Every SendiMessage resource is associated with a customer organization, and authorization is enforced server-side on every request: the organization is resolved from the authenticated credential, and queries are scoped to it. An authenticated customer cannot read, list, or act on resources belonging to another organization.

Operational practices

• Audit logging: Security-relevant actions are recorded: credential delivery, webhook creation and changes, line provisioning, invitations, and administrative actions.
• Request traceability: Every API response carries a correlation ID, so any request can be traced through the system during support or an investigation.
• Line health monitoring: Managed lines carry sending limits and continuous health monitoring that protects deliverability and flags degradation.

Data retention

Message and conversation history is retained to power the product's history, conversation, and delivery-tracking features. We have not yet published formal retention windows — a formal retention policy is being defined, and we say so rather than inventing numbers. If your review needs specifics for a category, ask us and we'll give you the current factual answer.