Security
Built to be trusted with your customer conversations.
Here is what Yuvix API does today to protect your workspace. We describe controls, not certifications — we don't claim compliance certifications we haven't been audited for.
Workspace isolation
Every query for contacts, conversations, campaigns, integrations and billing is scoped to your workspace on the server. Automated tests verify one workspace can't read another's data.
Role-based access
Owner, Admin, Manager, Agent and Viewer roles. Permissions are checked on the server for every sensitive operation — never only in the browser.
Credential encryption
WhatsApp access tokens, telephony secrets and AI keys are encrypted with AES-256-GCM and never sent back to the browser after you save them.
Password & session security
Passwords are hashed with scrypt. Sessions use HttpOnly, Secure, SameSite cookies, and you can sign out of every device from your account page.
Verified webhooks
Inbound webhooks from Meta, telephony and payment providers are signature-verified and de-duplicated before they're processed.
Audit logs
Sign-ins, exports, role changes, credential updates and campaign launches are recorded with actor and timestamp.
Accountable support access
Platform staff can only view a workspace through a time-limited, read-only support grant that is itself audit-logged.
Defensive defaults
Rate limiting on authentication and APIs, strict input validation, security headers (CSP, HSTS, frame denial) and redacted logs.
Your data, your control
Export your contacts as CSV at any time (with permission). Deleting a workspace removes its data from the primary database.
Responsible disclosure
Found a vulnerability? Please report it privately through our contact page with the subject “Security”. Don't access data that isn't yours, and give us reasonable time to fix the issue before disclosure.