Security at NexSent
Your data and your subscribers' data deserve protection. Here's how we keep it safe at every layer.
Security Measures
Every layer of our stack is built with security in mind — from network to application to data.
Encryption in Transit
All data between your browser and our servers is encrypted using TLS 1.2+. API calls, dashboard access, and email submission all use HTTPS.
Password Security
Passwords are never stored in plain text. We use bcrypt with per-user salts for cryptographic hashing. Even we cannot see your password.
Email Authentication
Every sending domain requires SPF, DKIM, and DMARC configuration. DKIM uses 2048-bit RSA keys for message signing, ensuring emails cannot be forged.
Data Isolation
Each user's data — contacts, campaigns, analytics, and settings — is logically isolated. No user can access another user's data, even through the API.
Infrastructure Security
Our servers run on hardened Linux systems with firewall rules, SSH key authentication, and regular security updates. Non-essential ports are closed by default.
Access Controls
API keys support granular permissions, expiration dates, and IP restrictions. Admin actions are logged for audit purposes.
Bounce & Abuse Processing
Automated bounce processing removes invalid addresses immediately. Abuse complaints trigger instant suppression to protect sender reputation and prevent unwanted emails.
DNS Verification
Domain ownership is verified through DNS record checks before any email can be sent. This prevents unauthorized use of domains on our platform.
WhatsApp API Security
WhatsAppWhatsApp messages are sent through Meta's encrypted Cloud API. Access tokens are stored securely and never exposed to the frontend. API calls are authenticated with system-level tokens.
Conversation Privacy
WhatsAppWhatsApp conversations and chatbot interactions are stored with the same encryption and access controls as email data. Conversation data is isolated per user account.
Our Security Practices
Comprehensive security controls across our platform and infrastructure.
Platform Security
All authentication tokens are JWT-based with expiration and secure storage
Rate limiting on all API endpoints to prevent abuse and brute-force attacks
Input validation and sanitization on all user-submitted data
MongoDB queries use parameterized operations to prevent injection attacks
File uploads are restricted by type and size with server-side validation
Session management with secure, HTTP-only cookies
Regular dependency audits for known vulnerabilities
Automated bounce processing to maintain IP reputation and prevent abuse
WhatsApp Security
WhatsAppWhatsApp access tokens encrypted at rest
Meta webhook signature verification for incoming WhatsApp events
Rate limiting on WhatsApp API endpoints
Secure storage of WhatsApp media files
Report a Security Issue
If you discover a security vulnerability, please report it responsibly. We take all reports seriously and will respond promptly.
security@nexsent.net