Security

Integration credentials — WhatsApp access tokens, SMTP passwords, provider API keys — are encrypted at rest using symmetric encryption with a key held in the application environment rather than in the database.

Secrets are write-only in the interface. You can replace a stored credential but you cannot read one back, including as an administrator. A settings screen that redisplays a stored API key is an exfiltration route for anyone who obtains a single session.

Permission is resolved in one place that every authenticated request passes through, rather than being re-implemented per endpoint. Approximately 350 endpoints are governed by that single check.

Platform administration and workspace roles are separate planes and do not cross: a workspace owner cannot acquire platform-level powers by editing a role definition.

Visibility follows the organisation chart. A manager sees their own reporting tree, and aggregate figures are scoped exactly as lists are — a total that includes records you cannot open is a disclosure with extra steps.

Isolation is structural rather than filter-based. Integration callbacks must echo the workspace identifier they were issued for, and are matched on both the session and that workspace before anything is written.

Multi-tenancy enforced only by a query filter somebody remembered to add is enforced until the day somebody forgets.

Status changes made by automation record the person whose action caused them. Merges, permission grants, opt-out list clearing and integration changes are recorded.

Activity and message logs are available in the product with filters, a detail view and export.

sayl.in is a statically generated site served as files. It runs no application server, no database and no session handling.

Fonts are self-hosted, so your browser makes no request to a third-party font provider when loading these pages. No advertising or social tracking scripts are loaded.

The enquiry forms and the visitor analytics beacon both post directly to the Sayl application's own endpoints. Nothing on this site sends anything to a third party — see the privacy and cookie pages for exactly what is recorded.

Sayl does not currently hold SOC 2 or ISO 27001 certification, and does not claim either. If a certification badge appears on this site in future, it will be because there is a certificate behind it.

REPLACE: penetration testing cadence, incident response and disclosure commitments, and backup and recovery objectives, once these are formally defined and can be stated accurately.

If you believe you have found a security issue, email info@sayl.in with enough detail to reproduce it. Please give us a reasonable opportunity to fix the issue before disclosing it publicly.

REPLACE: a dedicated security contact address, response-time commitment and safe-harbour statement for good-faith research.