Bank grade security. Shop floor simplicity.
We built Ecomsixx as if a Fortune 500 CISO would review it - because a BD shop owner deserves the same standard. Here is exactly how we protect your business and your customers' data.
What we do, so you can stop worrying about it.
Encryption at rest and in transit
Every access token you paste (Meta, WhatsApp, etc.) is encrypted with AES-256-GCM before hitting our database. The encryption key never leaves our Convex backend. All API traffic uses TLS 1.2+ (HTTPS enforced everywhere, including our SMS provider integration).
- AES-256-GCM for Meta/WhatsApp/Instagram access tokens
- HTTPS enforced on every endpoint (including BulkSMSBD SMS gateway)
- SHA-256 hashing for API keys with only the prefix visible in UI
- Random 32-byte session tokens generated via Web Crypto (CSPRNG)
Multi-tenant isolation
Every query, mutation, and action in our backend requires a session token and verifies membership before returning data. There is no shared state. A malicious user in one shop cannot see or modify another shop's data even if they know the internal ID.
- Every Convex handler calls requireMembership() with session + businessId
- External API keys are permission-scoped (write:orders, etc.)
- Cross-tenant storage attach prevented via storageOwnership table
- Audited 2026-08-02: 11 critical isolation bugs found + fixed
Prompt injection + SSRF protection
Scraping shop websites means processing untrusted content. We wrap all scraped HTML in <SITE_CONTENT> delimiters with an explicit safety directive to Claude. Our scraper blocks internal IPs (127.0.0.1, RFC1918 ranges, cloud metadata endpoints) at multiple redirect hops.
- URL scheme allowlist (https, http public only)
- Private IP block (loopback + RFC1918 + link-local + metadata)
- Manual redirect handling with re-validation at each hop (up to 3 hops)
- Prompt injection wrappers on all untrusted-content Claude calls
Rate limits everywhere
Every sensitive endpoint has a sliding-window rate limit. OTP sends are 3/minute per IP. Campaign sends are 3/hour per user. Voice calls (when we ship them) will be 60/minute per shop. Full list in our security audit.
- OTP: 3/min per IP + 5/hr per phone
- Campaign send: 3/hr per user
- Auto-provisioning: 5/hr per user (LLM cost guard)
- Chat webhook: 60/min per business (spam guard)
AI kill switch (big red button)
If your AI ever sends a rogue reply, click the Pause AI button in the dashboard header. All auto-replies stop within 30 seconds. Every incoming message hands to you until you resume. Feature exists because we know AI is imperfect and your brand comes first.
- Always-visible button in header on every dashboard page
- 2-click confirm before pausing (prevents accidents)
- Paused shops still receive customer messages - they just do not auto-reply
- Instant resume when you are ready
DPDP + BD compliance
Our privacy policy is written in accordance with Bangladesh's Draft Data Protection Act. Data subjects (your customers) can request their data. We anonymize before training. We never sell your data or your customers' data.
- Explicit lawful basis per processing category
- Data minimization (OTP codes redacted from SMS delivery log)
- Right to export, correct, delete - 30-day response SLA
- Cross-border transfer noted (Convex is US-hosted, TLS-encrypted)
Uptime commitments
| Plan | Monthly SLA | Credit if we miss |
|---|---|---|
| Growth | Best effort | None |
| Pro | Best effort | Service credit on request after a long outage |
| Business | Best effort | Service credit on request + root cause report |
| Enterprise | Agreed in your contract | As agreed, with a named incident contact |
Incident response
You tell us, or we notice: report anything broken to support and it reaches a human
We acknowledge within one business day and tell you what we know
We post what is broken and what we are doing about it while we work
Full post-mortem within 5 business days of resolution
Data breach: 72-hour notification per DPDP guidance
Your data is safe with us.
Seven day free trial, no card. Full security audit summary on request.
Book a scoped pilot for your team. We set everything up for you - from channel connection to product training.