Security

Access with purpose.

Workspace permissions, controlled sender approval and traceable actions, designed in from the start.

Owner, admin, manager, developer, finance and viewer roles. Every request checks the signed-in member and the permission it needs.

Keys belong to one workspace, live and test keys are separate, and keys can be rotated or revoked at any time.

Operator and channel credentials live in server configuration, never in browser code or support requests.

Sender IDs are registered with the operators before use, so customers only see names that belong to you.

Opt-outs are honoured at send time, and campaign audiences are checked against them automatically.

Changes to templates, contacts, approvals, team members and settings are recorded with who and when.

The facts

In transit: TLS on every connection: your application to the API, the workspace, and our links to operators and channel providers.
Credentials: Channel and operator credentials are encrypted at rest and are never returned by the API or shown in the workspace after they are saved.
Accounts: One Malipopay account per person, with a second factor by authenticator app, SMS or email, and sessions that can be ended from any device.
Keys: One live key per workspace at a time. Rotating a key expires the old one immediately.
Reporting: Found something? Report a security concern. Do not include passwords or API keys in the message.

Create your account in a minute. Prepaid in shillings, no card needed, and our team is one message away.

Larger volumes or a bank? Talk to sales