Security.

• Hosting. The API, workers, database and cache run in Microsoft Azure, Sweden Central (EU). The database runs with zone-redundant high availability.
• Encryption. TLS for all data in transit to our public endpoints. Encryption at rest for the database and backups (Azure storage encryption). The credentials that Customers give us for their delivery providers are also encrypted at the application level with a separate key.
• Network. Public traffic to the API and dashboard enters only through Cloudflare. Database connections need credentials and TLS and are limited by firewall rules. We are moving the database to a private network.
• Access control. Each workspace is isolated by organisation and app. Ingestion keys are split into publishable keys (for apps and browsers) and server keys (for backends), with separate rate limits. Only a small number of named staff can access production systems.
• Secrets. Production secrets are kept in Azure Key Vault, not in source code.
• Data minimisation. The API does not store End User IP addresses. The SDKs do not collect advertising IDs or precise location. A filter removes contact data, links and IDs from event values before any AI request. Contact addresses and traits are removed from failed-payload records.
• AI providers. We call AI models through business APIs whose terms do not allow training on our data. We do not send email addresses, phone numbers or push tokens to AI providers.
• Backups and recovery. Automatic database backups with 14-day point-in-time restore, copied to a second Azure region in Sweden.
• Secure development. Code changes go through pull requests. Automated tests run on pull requests.
• Personnel. Staff and contractors are bound by confidentiality obligations.
• Incidents. Security reports go to security@whisperr.net. We investigate, contain and notify as in Section 9.

We prefer to say what is not done yet:

• Moving the production database to a private network.
• Encrypted storage of End User contact addresses by default. The code exists. It is not on for all workspaces yet.

We do not hold a SOC 2 report or an ISO 27001 certificate today.

If you think you found a security problem in Whisperr, please email security@whisperr.net. Include:

• what you found and where (URL, endpoint or SDK);
• the steps to reproduce it;
• the possible impact;
• how we can contact you.

What we promise

• We confirm that we received your report within 3 business days.
• We keep you informed while we fix the problem.
• We credit you when the fix is out, if you want credit.
• We will not take legal action against you for research that follows these rules in good faith.

Rules

• Test only with accounts and data that you own. Do not access, change or delete other people’s data. If you see such data by accident, stop and tell us.
• Do not run denial-of-service tests, spam, social engineering or physical attacks.
• Do not test third-party services (for example our providers). Report problems in them to their owners.
• Give us reasonable time to fix the problem before you disclose it in public.

In scope: whisperr.net, app.whisperr.net, api.whisperr.net, docs.whisperr.net and the Whisperr SDKs. We do not run a paid bug bounty program at this time.

A machine-readable contact file is at /.well-known/security.txt.

• How we handle personal data: Privacy Policy.
• Who processes data for us: Sub-processors.
• Our commitments to Customers, including breach notice within 48 hours: Data Processing Addendum.
• Security questionnaires: security@whisperr.net.