Security

Your clients' data, kept apart and kept safe.

Agencies hold other people's leads. That is a responsibility, and we built the product around it. This is what we do today, in plain language.

Every client is fenced off in the database: Each workspace's data is separated by the database itself: a request for one client can only ever see that client's rows, whatever the application code asks for. A mistake in a screen or an endpoint cannot show another client's leads, because the database refuses to return them.
Secrets are encrypted at rest: Tokens you give us (for example a WhatsApp Business token) are encrypted with AES-256-GCM using keys kept outside the database, with support for key rotation. They are never displayed again after you save them. Traffic is encrypted in transit and the site sends HSTS.
Passwords and sessions: Passwords are stored only as salted, deliberately slow hashes (Argon2id where the server supports it). The policy favours length over arbitrary symbol rules and rejects passwords that contain your name or e-mail address. Sign-in cookies are HttpOnly, Secure and SameSite, use the __Host- prefix over HTTPS, and every state-changing request is protected against cross-site forgery. You can see and end your sessions at any time.
Two-factor sign-in: Anyone can turn on authenticator-app codes (TOTP) with one-time recovery codes. Turning it off needs the password and a code. Our own administration panel can be locked so that it only opens after a two-factor sign-in.
Rate limits and abuse protection: Sign-in, sign-up, password reset, API keys, contact forms and lead intake are rate-limited, and repeated wrong guesses slow down instead of getting more information. Responses to unknown accounts and wrong passwords are deliberately identical.
An audit trail for every workspace: Who changed what, and when, is recorded for each workspace and can be filtered and exported. There is no way to edit or delete an entry from inside the CRM. Actions taken by our own staff on customer accounts are kept in a separate log that is hash-chained, so a removed or altered entry is detectable.
Safe integrations: API keys are shown once, stored only as hashes, limited by scope, and can expire or be revoked. Incoming deliveries are verified (Meta signature, Google key, your own HMAC or key). Outgoing webhooks are signed, retried, and refused if they point at private or internal networks, which blocks attempts to use them to reach our own infrastructure.
Who at Anibros can see what: Staff access to the administration panel is granted explicitly, by role, and checked on every request. Entries are sealed with a secret that is not stored in the database, so a record added by hand grants nothing. Every administrator action is logged with who did it.
Payments: Cards, UPI and net banking are handled entirely by Razorpay on its own pages. Card numbers never touch our servers, and we do not store them. Payment confirmations are verified by signature before they change anything.

Honest limits

What we don't claim

Security is a process, and you should know where we are.

We do not yet hold formal certifications such as ISO 27001 or SOC 2. The controls on this page are what we actually operate.
The application runs on a hosting platform we choose and manage. Someone with access to the server itself could in principle reach anything on it, which is why access to it is limited and protected with two-factor sign-in.
We cannot protect a lead list you export and e-mail around, or a password you reuse elsewhere. Two-factor sign-in and scoped API keys exist so that a single leaked secret is not the end of the story.

Reporting a problem

Found something? Tell us first.

If you believe you have found a vulnerability, please write to us through the contact page and choose Security as the topic. Include what you found and how to reproduce it. Please do not access other people's data or disrupt the service while testing. We will acknowledge your report, keep you informed, and credit you if you wish once it is fixed.

Report a security issue

Your data, your control

You can export your leads and activity as Excel or CSV at any time, and read everything through the API. If you stop using the product, your workspace stays readable and exportable after a subscription ends; ask us and we will delete your data. Operational logs are kept for 90 days and finished background jobs for 30 days. See the privacy policy for the details.

Questions from your security team?

Send them over. We would rather answer a hard question now than have you wonder later.