Security & Trust

Security is foundational to MessagePipe. This page summarizes how we protect your data and the data you send through the platform. For processing terms, see our Data Processing Addendum.

Tenant isolation

Every workspace is isolated at the database layer using row-level security and scoped database roles, so one tenant cannot read another tenant's data.

Encryption

Data is encrypted in transit (TLS). Sensitive secrets, including provider credentials and signing keys, are encrypted at rest using envelope encryption with a managed key service.

Access control

Access to production is restricted and audited. Workspaces support role-based access (owner, admin, developer, marketer, viewer), and sensitive operations are gated and recorded in an append-only audit log.

Authentication

We support strong passwords, two-factor authentication (TOTP), passkeys (WebAuthn), and optional social sign-in. Sign-up and sign-in are protected by rate limiting and abuse controls.

Compliance

The platform is built to support SOC 2, GDPR, and HIPAA requirements. For the current status of our certifications and to request documentation, contact security@messagepipe.com.

Reporting a vulnerability

If you believe you have found a security issue, please email security@messagepipe.com. We appreciate responsible disclosure and will respond promptly.