You're trusting us with your customers' phone numbers. Here's what we do about that.

On servers in India, with daily backups. Your contacts, chats, invoices and settings stay in your own workspace. WhatsApp messages travel through Meta's infrastructure, as they do for every WhatsApp Business Platform provider, and payments are processed by your own gateway. Backups are kept on Indian servers too.

Secrets such as gateway keys and WhatsApp tokens are encrypted and can't be read even in our admin. Support staff only look into a workspace when you ask for help with something specific. We don't sell data or use one business's data for another. Access is limited to what's needed.

Not yet, and we'd rather say so plainly. The safeguards listed on this page are in place and most are checked by automated tests on every change, but we haven't been through a formal SOC 2 or ISO 27001 audit. We'll update this page if that changes.

No. Customers pay on the PCI-DSS certified checkout of Razorpay, Cashfree or Stripe, using your own account. Marketiism only receives a signed confirmation of the result, such as paid or failed, and never sees card numbers, UPI PINs or bank login details. Refunds also go through your gateway.

Every business works in its own workspace, and every database query is scoped to that workspace. Automated tests try to read one workspace's data from another on every code change and fail the build if they succeed, so a mistake can't quietly reach production. Agencies get the same separation per client.

We publish a data protection notice under India's Digital Personal Data Protection Act, 2023, explaining our role, what we process, your rights and how to reach the grievance officer. For your own customers' data, you are the data fiduciary and we process it for you.

Yes. Owners and admins can protect their accounts with two-factor sign-in, and anyone can sign in with their mobile number and a 6-digit code. We recommend two-factor for every account that can see billing or connected payment and WhatsApp accounts. It takes about a minute to switch on from your account security page.

Payment and WhatsApp events are only accepted when they carry a valid signature from Razorpay, Cashfree, Stripe or Meta, so nobody can fake a payment by calling our endpoint. Webhooks we send to your systems are signed too, and the developer docs show how to verify them.

Our data protection notice sets out how we handle personal data breaches, including notifying affected businesses and the authorities where the DPDP Act requires it. We would rather prevent one, which is why isolation tests, encryption and signed webhooks run on every change. You'd hear from us directly.

Write to us privately through the contact form and choose 'Something else'. Please don't post details publicly first. We reply within two business days, keep you updated while we fix it, and will credit you publicly if you'd like. There's no paid bug bounty yet.

Yes. Delete your workspace from settings, or ask us in writing through the contact page. The data deletion page explains each route, including removing Marketiism from your Facebook settings. Backups age out on their normal schedule after deletion. Export anything you need to keep before you delete, because deletion can't be undone.

Team members you invite can see the inbox and contacts their role allows, and chats can be assigned so each person works their own queue. The accountant role can't see chats at all; it only gets read-only billing, GST and accounts. Owners can change roles at any time.

Yes. Sign-in, sign-up and public forms are rate limited, and spam and click floods are filtered before they reach your CRM. That protects your account from password guessing and keeps junk enquiries out of your pipeline and your reports. Real customers don't notice the checks at all.

Yes, daily, on servers in India. Backups let us restore the service after a failure. They aren't a replacement for your own exports, so download your contacts and invoices regularly if you need copies for your records or your CA. Exports take a minute from the contacts and billing screens.

No. The AI uses your business knowledge and the current conversation to answer your customers, through Google's Gemini models. We don't use one business's chats to answer another business's customers or to advertise to anyone, and you can read every AI reply. Your knowledge stays in your workspace.