You're sending us your customers' conversations. That's a real responsibility, and one we take seriously. This page lays out what we do — encryption, authentication, isolation, hosting, and access — in plain words, not marketing.
| No. | Property | Value |
|---|---|---|
| 01 | Data hosting region | India (ap-south-1) · Mumbai region |
| 02 | Encryption in transit | TLS 1.3 · HSTS enforced · Let's Encrypt certificates auto-rotated every 60 days |
| 03 | Password hashing | PBKDF2-SHA256 · 120,000 iterations · per-user salt |
| 04 | Session cookies | HttpOnly · Secure · SameSite=Strict · HMAC-signed |
| 05 | Multi-tenant isolation | Every query scoped by tenant ID · access checks enforced at the row level |
| 06 | Content Security Policy | Strict CSP · no inline scripts · no third-party trackers embedded |
| 07 | Data export | CSV export available any time · PII redaction for shared exports |
| 08 | Data deletion | Immediate account deletion on request · 30-day recovery window · full purge after |
| 09 | Meta compliance | Built on official WhatsApp Business Platform · templates submitted through Meta's approval flow |
| 10 | Backups | Nightly encrypted snapshots · retained 7 days · restore tested monthly |
Every byte we hold — messages, contacts, templates, analytics, backups — is stored on servers physically located in India. We use the ap-south-1 (Mumbai) region. Your data does not leave India. There is no cross-border transfer, no US region fallback, no shadow copy elsewhere. This is a deliberate choice for Indian SMBs whose customers' personal data should stay under Indian jurisdiction.
Every connection to Cosmos Connect uses TLS 1.3 with modern ciphers, and HSTS is enforced with a one-year max-age so browsers won't downgrade the connection. Certificates come from Let's Encrypt and rotate automatically every 60 days. Data written to disk is encrypted at rest via disk-level encryption, and backups are encrypted separately with independent keys.
strict-transport-security: max-age=31536000 content-security-policy: default-src 'self' x-frame-options: DENY x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin
Passwords are hashed with PBKDF2-SHA256 using 120,000 iterations and a per-user random salt — even if a database dump ever leaked, the passwords are not reversible in any reasonable time. Session cookies are HttpOnly (JavaScript can't read them), Secure (never sent over plain HTTP), SameSite=Strict (immune to cross-site abuse), and HMAC-signed (any tampering invalidates the session immediately).
Every teammate gets their own login with a role — Admin, Manager, Agent or Marketing — so people only see and do what their job needs. Admin accounts can turn on two-factor authentication with an authenticator app. When a password is changed or a teammate is deactivated, their existing sessions are logged out instantly.
Every business on Cosmos Connect is a separate tenant. Every database query is scoped by tenant ID, and every access check runs at the row level — meaning a bug that tries to fetch another tenant's data still gets zero rows back. There is no shared inbox, no shared contact list, no shared analytics. You never see another business's data, and no business ever sees yours.
SELECT * FROM messages WHERE tenant_id = :current_tenant AND ...
You can export your contacts and messages as CSV any time from the dashboard. Shared exports (analytics dashboards, aggregate reports) have PII redacted by default. If a customer asks you to delete their record, you can delete a single contact and all their conversation history from your inbox. If you delete your whole account, we keep an encrypted snapshot for 30 days as a safety net, then purge everything — data, backups, logs.
A small engineering team, all in India, with production access limited to the two founders and one senior engineer. All production access is logged, and any access to a specific tenant's data requires explicit approval (from you, in support cases) or an incident ticket. We never look at your customers' messages for training data, marketing, or any other purpose.
In the event of a security incident affecting your data, we notify you by email within 72 hours of confirmation, with a plain description of what happened, what data was involved, and what we're doing. This applies whether the issue is our fault, a vendor's, or an attacker's.
What we collect, why, and who we share it with (spoiler: we don't).
Read the policy →Vendor questionnaires, contractual security addenda, responsible disclosure — we handle all of it. Reach us at security@cosmosconnect.io or general partnership requests at partners@cosmosconnect.io.