Security and Trust

Where your data lives

• Servers and database: netcup GmbH, in Germany (European Union).
• Files, call recordings and database backups: Backblaze B2, in the United States.
• Everything else we use, and where it runs, is on our Sub-processors list. A transfer out of the EEA, the UK or Switzerland is covered as the Data Processing Addendum describes.

How we protect it

• In transit: every Commstate address is HTTPS only, and browsers are told never to use plain HTTP with us (HSTS).
• Separation: each business's data is kept apart from every other business's, and every request is checked against the business it belongs to.
• Accounts: passwords are stored hashed, never as text. Two-step verification is available to everyone, with an authenticator app or a phone code. Repeated sign-in attempts are slowed down and then blocked.
• Access: staff see only what their role allows. Sign-ins and important changes are recorded in each business's activity log and login history.
• Secrets: the keys and passwords a business connects (payment, messaging, shipping) are stored encrypted.
• Payments: card and bank details are entered on Razorpay's own page and never reach our servers.
• Backups: the database is copied every six hours, on our servers and off-site, and copies are kept for about 14 days.
• Test systems: our test environment cannot message real customers. WhatsApp and Instagram sends there reach only an allowlist of test numbers.
• Messaging: WhatsApp runs on Meta's official WhatsApp Business Platform, never on an unofficial connection to a phone.

Certifications and standards

We say here only what is true today, and we update this page as that changes.

| Standard | Where we are | |---|---| | PCI DSS | Card data never reaches us. We are completing the self-assessment for businesses that use a hosted payment page (SAQ-A) | | ISO/IEC 27001:2022 | Working towards certification; our security policies follow it | | GDPR and UK GDPR | We act as a processor for the businesses that use Commstate, under our Data Processing Addendum | | India's DPDP Act | Our Privacy Policy and Grievance Officer follow it | | WCAG 2.1 AA | See our Accessibility Statement | | SOC 2 | Not yet; planned once our customers need it |

Businesses that need our security questionnaire answered, or a copy of a policy, can ask at security@commstate.app.

If something goes wrong

If we learn of a breach that affects personal data, we tell the businesses affected without undue delay, as the Data Processing Addendum sets out, and we report to the authorities where the law requires it, including to CERT-In in India within six hours.

Reporting a vulnerability

If you think you have found a security problem in Commstate, please tell us at security@commstate.app. Our machine-readable contact is at /.well-known/security.txt.

Please include what you found, where (the address or screen), how to reproduce it, and what an attacker could do with it. Screenshots or a short video help.

We will:

• reply within 3 working days;
• keep you told of progress, and tell you when it is fixed;
• not take legal action against you, or ask anyone else to, for research that follows this policy;
• credit you below when it is fixed, if you would like.

While you look, please:

• use only accounts and shops you own, or have permission to test;
• never read, change or delete other people's data; if you reach some by accident, stop, and tell us what you saw;
• never send messages, calls or orders to real people;
• not run tests that slow the service down for others (load tests, denial of service), and not use automated scanners at high volume;
• not try social engineering, phishing or physical access against our staff or offices;
• give us a reasonable time to fix a problem before you tell anyone else about it.

Out of scope: reports from automated scanners with no shown impact; missing headers or settings with no shown way to exploit them; clickjacking on pages with no sensitive action; rate limits on non-sensitive forms; problems in a business's own website or a third party's service; and anything needing a device that is already compromised.

We do not pay rewards at the moment.

Thanks

We thank the people who have reported security problems to us responsibly. None yet: you could be the first.