Messagify Technologies Pvt. Ltd.

Security & Compliance

Last Updated: August 2026Hosted in India on Google CloudDPDP Act, 2023 — In Progress

Messagify operates a cloud-based, multi-tenant SaaS platform that helps organizations manage business operations, customer information, workflows, engagement, and communications across multiple industries and use cases. Communication services may include SMS, WhatsApp, RCS, Email, chatbots, and other business communication capabilities depending on the customer's configuration.

We protect information through layered controls covering encryption, authentication, authorization, tenant isolation, access management, application security, monitoring, audit logging, backup and recovery, and operational security. Our security program is continuously improved as our platform, customer requirements, and applicable obligations evolve.

1Security Controls

Area	Current Control	Status
Encryption	HTTPS/TLS in transit; sensitive customer information encrypted using AES-256-GCM; Google Cloud encryption at rest.	Active
Identity & Access	RBAC, tenant authorization, token expiration, least privilege; MFA required for privileged internal access and available to customer accounts.	Active
Tenant Isolation	Shared multi-tenant architecture with logical tenant separation; requests authenticate, identify tenant, authorize resource, then query authorized tenant data.	Active
API Security	Authentication, rate limiting, request-size/input validation, CORS, CSRF protection where applicable, audit logging.	Active
Secrets	Production secrets, credentials and API keys managed through Google Cloud secret-management capabilities; not stored in source control.	Active
Monitoring	Application/infrastructure monitoring, automated alerts and audit logging; PII exposure in logs is minimized.	Active
Production Access	Production database access restricted to authorized personnel; privileged activity logged where supported.	Active
Backup & Recovery	Database backup and recovery capabilities; target RTO < 4 hours and target RPO < 1 hour. Targets are not guaranteed and require formal validation.	Active
Edge Security & DDoS Mitigation	Our internet-facing services use cloud-based edge security controls designed to mitigate DDoS attacks and malicious traffic.	Active

2Application, Tenant & Operational Security

Tenant authorization is applied before tenant-specific resources are accessed. Logical tenant isolation is treated as a critical security boundary. Incident response covers identification, assessment, containment, investigation, remediation, recovery, customer communication where applicable, and post-incident review.

Vulnerability management includes security updates, dependency monitoring, application/infrastructure reviews, secret scanning and severity-based remediation. Messagify has not yet completed an independent penetration test of its production application and APIs; this is planned. Planned

3Data Privacy & Retention

Messagify is implementing a privacy program aligned with applicable Indian data-protection requirements, including the Digital Personal Data Protection Act, 2023 and applicable Rules. The program covers data inventory/classification, data-flow mapping, consent where applicable, data-subject rights, retention/deletion, vendor management and privacy governance.

Retention requirements are being formalized by data category, purpose, contractual requirements and applicable law. Formal automated retention/deletion controls are in progress.

Messagify's primary production application and database infrastructure is hosted in India. Where communication services require third-party processing, information necessary for delivery may be transmitted to the applicable provider under relevant contractual, security and legal requirements.

4Communication Infrastructure & Shared Responsibility

Messagify works with authorized communication and technology providers to deliver our supported services, including messaging APIs, communication channels, platform integrations, and related infrastructure.

Messagify's Responsibility

We apply appropriate technical and organizational safeguards to protect data within systems under our control and work with our service providers to maintain appropriate security measures for data in transit and at rest. Messagify is responsible for securing the systems and services we operate, including application security, customer data stored on our platform, authentication, authorization, tenant isolation, and applicable privacy and security controls.

Customer Responsibility

Customers are responsible for using Messagify lawfully and securely, including obtaining any required consent or permissions, ensuring that their communications and message content comply with applicable laws and regulations, protecting their account and API credentials, and following the requirements applicable to the communication channels they use.

Provider Responsibility

Our communication and technology providers are responsible for the security of the infrastructure and services they operate, subject to their applicable contractual, technical, and legal obligations.

5Regulatory Compliance

SMS Sender ID & Template Registration

SMS messages sent through the Messagify platform are routed through authorized connectivity infrastructure, with sender IDs and message templates registered on the Distributed Ledger Technology (DLT) platform as applicable messaging regulations require. We handle this registration as part of customer onboarding.

DLT-registered sender IDs and message templates
Consent-based promotional messaging enforcement
NDNC / DND scrubbing on promotional SMS routes
Time-restriction enforcement (9 AM – 9 PM IST for promotional messages)

WhatsApp Business API

The Messagify platform integrates with the official WhatsApp Business API via Meta's approved partner ecosystem. All WhatsApp message templates are subject to Meta's review and approval process before they can be used in campaigns.

Messaging Infrastructure

Messagify Technologies Pvt. Ltd. is the customer-facing platform and brand for every channel described on this site. Messages are delivered through authorized connectivity infrastructure and partners, built to support applicable messaging, privacy and regulatory requirements — Messagify does not itself claim to own or operate telecom carrier infrastructure.

6Business Continuity & Disaster Recovery

Database backup and recovery capabilities are active. A formal disaster-recovery environment, documented failover procedures and periodic DR exercises are being developed. RTO/RPO figures stated above are target objectives pending formal DR validation.

7Compliance & Security Roadmap

DPDP compliance program

In Progress

ISO 27001

Roadmap

SOC 2 Type II

Roadmap

8Responsible Disclosure & Contacts

Security vulnerabilities should be reported privately to info@messagify.in. We aim to acknowledge valid reports within 48 hours, assess severity, prioritize critical issues, and coordinate remediation.

Please do not access, modify, delete or disclose customer data during testing, and allow reasonable time for investigation before public disclosure.

Security	info@messagify.in
Privacy	info@messagify.in

Active = implemented and operational
In Progress = being implemented or formalized
Planned / Roadmap = future program activity

This document describes Messagify's current security posture and does not constitute a certification or guarantee of absolute security.