Security

1. Our approach

We design RASSEL so each customer's data stays isolated and protected, and we describe here only what is actually implemented. We do not claim security certifications or approved compliance (such as ISO 27001, SOC 2 or PCI); card data is not stored by us in the first place.

2. Workspace data isolation

Each workspace is isolated from the others at the database level, and every request verifies which workspace the user belongs to before any read or write. We test isolation automatically: one workspace cannot read or change another's data, or send through its channels.

3. Permissions (RBAC)

Granular roles and permissions per user (workspace owner, manager, agent) are enforced on the server, not only in the screen. A user cannot see or change what is outside their permissions.

4. Encryption of credentials and keys

Channel keys, AI-provider keys and mailbox passwords are encrypted at rest and never displayed in any screen after saving (only a "configured" status is shown). API keys are shown once when created.

5. Passwords and sessions

• Passwords are stored with secure hashing and cannot be read by anyone.
• Sessions use secure cookies, with the ability to view and revoke active sessions.
• Rate limits on sign-in and reset attempts prevent automated guessing.
• Invitation and reset tokens are short-lived and single-use.

6. Audit log

Sensitive operations (who did them, when, from which address) are recorded in a read-only log, including acceptance of terms at payment and subscription changes.

7. Webhook verification

We verify the signature of provider webhooks (such as Meta and the payment gateway) using constant-time comparison before accepting them, and ignore duplicate events.

8. Payments

Card details are entered with the Moyasar gateway directly and never pass through our servers. The server confirms the amount and currency with the gateway before activating any subscription, does not trust what returns from the browser, and processes a duplicate payment once.

9. Secure transport

The platform is accessed over HTTPS, with browser security headers and protection against cross-site request forgery (CSRF).

10. Backups and continuity

We keep database backups under a documented procedure and run restore tests in an isolated environment. Backups do not replace your own export of essential data. We also have a maintenance mode that temporarily blocks writes during migration or maintenance.

11. Limits we state honestly

• We rely on external providers (Meta/WhatsApp, Moyasar, email, AI, cloud infrastructure) that have their own controls.
• We do not currently offer single sign-on (SSO), dedicated data residency or private infrastructure.
• No system is completely secure; we review and improve continuously.

12. Reporting a vulnerability

If you find a security issue, tell us before publishing it: [email protected]. We will handle it quickly and confidentially and thank you for your responsibility. Do not run penetration tests against real customer data without written permission.