Security Architecture & Operational Safeguards
Truthful, technical implementation details governing API credential protection, data isolation, and privacy masking.
API Key Security & Plaintext Masking
Client API keys use cryptographically secure random entropy. Keys are displayed in plaintext exactly once at issuance. Conduit stores only the salted bcrypt hash on disk, preventing plaintext exposure even in database snapshot breaches.
Provider Token Encryption at Rest
Downstream WhatsApp panel tokens and session identifiers are encrypted at rest using industry-standard symmetric encryption algorithms. Plaintext tokens are never returned by client configuration endpoints.
Strict Tenant Isolation
All client data access—including API keys, template usage mappings, and delivery receipts—is bounded by tenant ID. Cross-client query execution is structurally prevented at the data access layer.
Client-Scoped Webhooks
Status callbacks from messaging providers are verified and dispatched exclusively to the client tenant associated with the message, ensuring receipts never bleed across services.
Customer Phone Number Privacy Masking
In accordance with data minimization principles, recipient phone numbers stored in Conduit audit logs are masked (e.g. +91 ••••••4310) across all UI inspection panels.
Admin JWT Session Expiry
Management console sessions are authenticated using signed JSON Web Tokens with strict expiration windows and secure cookie handling. Passwords use bcrypt hashing.
If you believe you have discovered a vulnerability or security issue within Conduit, please contact our security team directly via our enterprise contact page.