Security
Your conversations are safe with us
Engage is built to OWASP ASVS Level 2 practices, with security controls in every layer of the platform.
Encryption everywhere
TLS 1.2+ with HSTS for all traffic. Meta business tokens, registration PINs and webhook secrets are encrypted at rest with AES-256-GCM using rotatable key ids; master keys never live in the database.
Tenant isolation
Every record is scoped to your organization from the authenticated principal — never from the request body — with Postgres row-level security as a second barrier and a cross-tenant test suite.
Access control
Seven built-in roles plus custom roles. API keys carry their own permission subset, optional IP allowlist and expiry, and are stored only as HMAC hashes.
Account security
Argon2id password hashing, TOTP two-factor with recovery codes, org-wide 2FA enforcement, login throttling and lockout, and session listing with revoke.
Audit trail
Security- and data-relevant actions are written to an append-only, hash-chained audit log, including any platform support access to your organization.
Signed webhooks
Inbound Meta webhooks are verified on the raw body. Outbound webhooks are signed with HMAC-SHA256 and protected by an SSRF guard.
Application hardening
Strict Content-Security-Policy, frame-ancestors none, CSRF tokens for dashboard requests, parameterised SQL and validated input on every endpoint.
Reliability
Durable queues, idempotent processing, point-in-time database recovery and daily backups. Stateless services scale horizontally.
Privacy & compliance
Built for India’s DPDP Act and GDPR: contact export and erasure, configurable retention, and a Data Processing Addendum.
Found a vulnerability?
We appreciate responsible disclosure. Email security@swastik.ai and we'll respond within two business days.
Read our privacy policy