Security & Privacy
How we protect the data that flows through AllyOneMail. This page covers principles and practices — for technical implementation details under NDA, talk to our team.
🔐 Encryption
All communication with the API runs over TLS. Integration credentials (ad tokens, SMTP, WhatsApp Business) are encrypted at rest. API keys are stored only as a hash — never in plain text.
🏢 Tenant isolation
Each customer only sees its own domains, sends and events — the scope comes from the credential, never from a request parameter. Reinforcement in the database itself (per-request Row Level Security, already active in AllyOneCRM) is being rolled out in AllyOneMail.
🔑 Two-factor authentication
Available on all accounts, based on standard TOTP (compatible with Google Authenticator, Authy and similar), with recovery codes.
📋 LGPD
Export and erasure of a recipient's data through the API (/api/v1/privacy; LGPD is Brazil's data-protection law, equivalent to GDPR), one-click unsubscribe and a suppression list. Operational data has fixed retention (webhook history: 90 days; idempotency keys: 7 days). Per-channel consent is managed in AllyOneCRM.
🛡️ Rate limits
Every public API is protected by rate limiting — see the real limits in Authentication.
🔍 Continuous auditing
Recurring security review of code and infrastructure, as part of the normal development process — not a one-off event.
Responsible disclosure
Found a vulnerability? We want to know before anyone else. Report it to caio.santos@allyonecorp.com — we respond to every good-faith report.
Where your data lives
Production infrastructure is in the European Union. For data subjects in Brazil, the international transfer is based on an adequacy decision (LGPD, art. 33, I): through ANPD Resolution No. 32/2026, Brazil's data protection authority recognized the European Union and the European Economic Area as providing an adequate level of protection, with no additional contractual clauses required. Customers who need data stored in Brazil can request a dedicated environment.