Security
The security questionnaire, answered on a public page
SSO, SCIM provisioning, IP allowlisting, retention windows, export controls, audit export and data residency — published entitlements, not a private quote.
SSO over SAML and OIDC
Your identity provider decides who gets in. Sessions are HttpOnly cookies; there is no token in browser storage to steal.
SCIM provisioning and de-provisioning
A leaver loses access because HR removed them, not because somebody remembered. De-provisioning is the half most vendors skip.
IP allowlisting
Restrict the organisation to your ranges, enforced server-side on every request rather than by hiding a menu.
Retention windows you set
How long conversations, messages and media are kept, per organisation, enforced by a job you can see the results of.
Export controls and audit export
Who may export what, and a tamper-evident audit trail that can itself be exported for your SIEM.
Data residency
Which region your organisation’s data lives in, chosen per organisation and enforced at the database-routing layer rather than promised in a PDF.
An entitlement on some plans and not others. The pricing table says which.
What a security review usually asks
Where is our data stored?
In the region your organisation chooses. Data residency is an Enterprise entitlement enforced at the database-routing layer, not a promise in a document: a request for an organisation pinned to a region cannot reach another region’s database.
How are sessions handled?
An HttpOnly, Secure session cookie. There is no access token in local storage and no bearer token in JavaScript, so there is nothing for a script on a page to steal.
Can we enforce SSO for everyone?
Yes. With SSO configured, your identity provider decides who signs in, and SCIM decides who still has an account. De-provisioning is the half that matters and the half most platforms leave out.
Is there an audit trail, and can we have it?
Yes. Every privileged action is recorded with the actor, the time and a request ID, and audit export lets you take the trail into your own SIEM on the Enterprise tier.
How long do you keep messages?
As long as you tell us to. Retention windows for conversations, messages and media are set per organisation and enforced by a job whose results you can see.
The rest of the product
Shared inbox
Assignment, teams, routing and SLA timers, with every agent in the same queue.
Campaigns
Template approval, segments, scheduling and delivery reporting that goes down to the message.
Automation
Trigger → condition → action flows, with business hours and a run history per execution.
AI
Draft replies, summaries and extraction — with the allowance printed and no overage.
Start the review during the trial
The audit trail, the retention settings and the SSO configuration are all visible during the trial, so a security review does not need to wait for a contract.