Controls you can verify
Hosting, isolation, roles, 2FA, vault, signed webhooks, audit log — stated plainly.
Built to be checked.
Not just believed.
This page is for the person who has to approve SM Gateway: IT, compliance or the owner. It lists the controls that exist today, the retention schedule, the AI data handling, and the things we do not yet have.
See plans and pricingA retention table, not a promise
What is deleted and when, the same table as the privacy policy.
What we do not have yet
No certifications, no DPA yet — said here, not discovered later.
Secrets in a vault
Tokens, connector secrets and sender credentials never leave the vault; keys are hashed and shown once.
Signed webhooks
Every delivery to your systems carries an HMAC-SHA256 signature.
Two-factor on sensitive changes
Roles, channels, API keys and sender credentials need an authenticator code.
01
Controls in place.
These are built into the application, not promises.
- Hosting: the application runs in a private data centre in the United Arab Emirates; the marketing website is served from DigitalOcean through Cloudflare.
- Isolation: every workspace is separated at the database level; one business can never read another’s data.
- Access: roles (Owner, Admin, Agent, WhatsApp Manager, Approver and custom roles) with branch and channel scoping; an authenticator-app code is required for sensitive changes such as roles, channels, API keys and email-sender credentials.
- Secrets: channel tokens, connector secrets, SMTP passwords and Resend or SendGrid keys live only in the secrets vault; API keys are hashed, scoped, rate-limited and shown once.
- Integrity: outgoing webhooks are signed with HMAC-SHA256; incoming webhooks are verified; every sensitive action is written to the audit log.
- Retention: attachments are kept 90 days, 1 year or without limit by plan; everything else follows the schedule below.
02
AI data handling.
AI features send only the content needed for the request — message excerpts, knowledge snippets, workflow inputs — to OpenAI or Anthropic, funded by your own key or by platform credit.
- SM Gateway keeps the text of an AI request for 24 hours by default and never more than 30 days.
- The conversation and knowledge data it was drawn from follow the workspace’s normal retention.
- Each provider keeps what its own policy states: our OpenAI calls are made with storage disabled, and OpenAI may retain requests for up to 30 days for abuse monitoring; Anthropic applies its own retention. Neither trains models on your data under our agreements.
- AI messages are marked as AI-generated for your team; the AI answers step replies only from your knowledge and hands over when asked.
03
What is deleted, and when.
The same table as in the privacy policy. Deletion covers the database, file storage and the secrets vault, and we instruct our providers to delete their copies on their own schedules.
| Event | Data | What happens |
|---|---|---|
| Channel disconnected | Access token, PIN, mailbox credentials | Revoked at the provider where possible and deleted immediately |
| Channel disconnected | Conversations, messages, media and delivery logs of that channel | Deleted 30 days after the disconnect; reconnecting the same account within 30 days cancels the deletion |
| Channel disconnected | Contacts that exist only through that channel, with no lead, task or activity | Deleted with the conversations after 30 days |
| Social profile removed | Posts, comments, commenter details, insights | Deleted after a 30-day grace period |
| Subscription ends (trial expired, cancelled, or unpaid past the grace period) | The whole workspace | Read-only for 30 days, then erased in full 90 days after the end date |
| Workspace owner requests deletion | The whole workspace | Erased after a 7-day cooling-off period, which the owner can cancel |
| A workspace admin erases a contact | The contact, its conversations, messages, media and activities | Erased immediately; an audit entry without content is kept |
| Deletion request by email (including requests from Meta) | The affected person’s data | Completed within 30 days |
| Any deletion | Invoices, credit notes and billing records | Kept 5 years as required by UAE tax law, with the workspace name and billing contact only |
| Any deletion | Opt-out and suppression records (STOP, unsubscribe, bounces, complaints) | Kept as a hashed suppression list so the person is never messaged again |
| Any deletion | Audit log | Kept 1 year, reduced to actor, action and time |
| Always | Pre-deploy database dumps | Expire within 30 days |
| Always | Workflow answers 30 days · AI request text 24 hours (30 days at most) · email events 90 days · email outbox 30 days · API and webhook logs 30 days · incoming webhook ledger 14 days · one-time codes 7 days · drafts 7 days · attachments 90 days, 1 year or unlimited by plan | Deleted on the schedule shown |
04
What we do not have yet.
We would rather you read it here than discover it later.
- No third-party certification or audit (ISO 27001, SOC 2). The controls above are our own statements.
- No data processing agreement to sign yet; the privacy policy and terms govern processing.
- Workspace deletion is requested from the application and completed by our team within the published timeline; there is no one-click erase for a whole workspace.
- The application interface is in English.
- Publishing, comments and insights for Facebook and Instagram are enabled on request until Meta completes its review of our application.
05
Report a security concern.
Write to the privacy address below with a description, the affected feature and steps to reproduce using non-sensitive examples. Do not send real customer messages, credentials or tokens. We acknowledge reports and address identified deficiencies; this page does not assert a certification or audit.
How it works
Read the controls
Everything above is in the application today; nothing is planned-tense.
Check the retention table
It is the same table the privacy policy publishes.
Ask us anything
Write to the privacy address; we answer from this page.
For IT and compliance
Approve it with your eyes open.
The controls, the retention schedule and the gaps are all on one page, so the person who signs off can do it from facts.
Start free trial Illustrative photo. Interface details use sample data.Questions, answered.
Where exactly is our data?
In a private data centre in the UAE for the application; website visits are served by DigitalOcean and Cloudflare. Providers such as Meta, Stripe, Resend, OpenAI and Anthropic process data abroad and are listed on the subprocessors page.
Can we get a DPA or a security questionnaire answered?
There is no standard DPA yet. For a questionnaire, write to the privacy address; we answer from the controls on this page.
Who can see our conversations?
Only members of your workspace, according to their role and branch; our staff access a workspace only for support you request or to operate the service, under the audit log.
How do we delete everything?
Disconnect channels (deleted after 30 days), let the subscription end (erased 90 days after), or request workspace deletion from Company Settings; the privacy policy has the full table.
Product screens are from the SM Gateway application with sample data. Cards and photos are illustrative.