Trust
Everything below describes what the product does today. The second half is the part most trust pages leave out: the certifications ShipMsg has not been audited against.
Bodies are sealed before they are stored, under a key derived per account and contact, so a database copy without the key material is not readable. Reads go through one decision point, which is why an unreadable message is reported as unreadable rather than rendered blank.
Meta access tokens and webhook signing secrets are sealed through a separate credential broker and resolved at the moment of use. The services that send messages hold them for the length of one request.
Row-level security is applied per table rather than trusted to application code, so a query that forgot its account scope returns nothing instead of someone else's data.
Changes to users, roles, API keys, webhooks, privacy requests, retention and legal holds are recorded with their actor and reason, and each entry hashes its predecessor, so a removed or rewritten entry breaks the chain. Not every change is audited yet — parts of contact, consent and media handling are still being added — and we say so rather than imply otherwise.
A marketing send without recorded consent is refused before it leaves. An opt-out reply stops marketing automatically — STOP and its equivalents in English, French, Spanish, Portuguese and Arabic, whatever the capitalisation or punctuation, plus keywords you add — and the person gets a confirmation. The suppression register is append-only: lifting a suppression is a recorded change, never a deletion.
Deliveries to your endpoint are signed so you can verify they came from us, with rotation and an overlap window. Outbound requests go through an egress guard so a webhook URL cannot be used to reach internal addresses.
Media is scanned for malware and held until it passes. A file that fails never becomes sendable.
Owners, admins and the Compliance manager role can put a hold on the whole account, a contact or a conversation from the console. While it stands, retention keeps everything in scope and erasure requests that touch it are parked with a message saying why. Placing and releasing a hold is audited, and releasing one needs a step-up.
Access, portability and erasure requests run as operations you can follow, and finish with a record of what was exported or erased. Message content and records are kept until you delete them or set a retention period of 30 days to 10 years; an hourly job applies the period you set.
No independent audit has been completed against any of these. If a procurement process requires one, say so early — it is a real answer either way, and we would rather give it now than during a security review.
ShipMsg is hosted in the United States today. Hosting in the European Union and in Africa is planned and not yet available, so an account cannot be placed there yet.
The production database is backed up before every release. An encrypted backup kept off the production server, with a scheduled restore test, is being introduced; until it is in place we do not promise a recovery window or a tested restore. Application logs are kept for 7 days.
If you connect your own WhatsApp Business Account (Embedded Signup), the account, your phone number and your templates are registered to your business with Meta and stay with you if you leave. Meta bills you directly, per delivered template message; ShipMsg is not in that transaction.
If ShipMsg hosts the account for you (for businesses Meta will not verify), the WhatsApp Business Account sits in ShipMsg’s own Meta business portfolio, so the account itself is ours and Meta bills its charges to us. Your messages, contacts, templates, conversation history and consent evidence remain yours and exportable, and leaving means moving the number to an account of your own; the terms set out how.
The contracting company is Bagadi LLC, a Texas limited liability company, and ShipMsg is its product. The Data Processing Addendum sets out the processor relationship and the subprocessor list names every third party involved.
security@shipmsg.com is not receiving mail yet. A report sent there will not reach anyone, so open a support case from the console instead. This page would be worth very little if it pointed you at an address that swallows the thing it is asking you to send.
Email security@shipmsg.com with the affected component, how to reproduce it and the impact. Do not include live customer data or destructive payloads. Full terms are on the security page.