Security and compliance, built for regulated markets.
Cast handles OTPs, payments alerts and customer conversations for teams in telecoms, fintech and retail. That means encryption, access control and local compliance aren't add-ons, they're built into how the platform works.
Encryption and access control by default.
Encrypted in transit
Every connection to the Cast console, API and webhooks is encrypted over TLS. Nothing you send us, or we send you, travels in the clear.
Credentials encrypted at rest
Channel credentials and secrets, such as WhatsApp tokens, SMTP passwords and SSO client secrets, are individually encrypted at rest with AES-256. API keys and recovery codes are stored hashed. Message content and contact records are not separately encrypted today, and encryption of the database volume is planned.
Role-based access
Invite teammates with the exact permissions their job needs, from a read-only viewer to an owner. Every sensitive action is written to an audit log you can review, and the log is append-only: the application cannot edit or delete audit rows.
Tenant isolation
Every account's data is scoped to that account. Automated tests check the contact, group, dealer and import paths.
Sign-in controls
OpenID Connect and SAML 2.0 single sign-on and SCIM provisioning are built, and we verify each connection against your identity provider during setup. Time-based one-time-password (TOTP) MFA is available, with recovery codes and a tenant-wide requirement.
A gate before every release
Each release passes an automated gate before it is published: compile, database contract tests, unit tests, a permission-catalogue check, a dependency audit and a browser smoke suite.
Aligned with GDPR and POPIA principles.
GDPR & POPIA aligned
Our privacy program follows the principles of GDPR (EU/UK) and POPIA (South Africa): lawful basis for processing, data minimisation, and defined retention periods.
Data processing agreement
A data processing agreement (DPA) is in preparation with counsel. We will not describe one as available until it is signed. Ask us for the current status.
No third-party data sales
We don't sell or share your customers' data with third parties for their own marketing. It's used to send and support the messages you ask us to send, and nothing else.
Built to keep running, and to tell you when it doesn't.
Always-on processing
Message delivery, journey execution and webhook dispatch run as background processors that each report a heartbeat, and we are alerted by email when one goes silent.
Live status page
A public status page shows component-level health for the API, messaging channels, inbox and dashboard.
View system status →Direct incident communication
If something breaks on our side, we tell you, rather than waiting for you to open a ticket. Enterprise agreements carry defined incident-communication and response terms.
Compliance built into the send path, not bolted on after.
Per-country sender rules
Sender ID formats, registration and content rules vary by country. We apply them for each market you send into.
Opt-in & opt-out enforced
STOP and HELP keywords are recognised automatically on SMS and WhatsApp, and honoured on every future send on that channel, not just the campaign it arrived on.
Sender registration by market
Where a market requires sender registration or know-your-customer checks, we collect what the local operator asks for before a new sender goes live.
Consent-first sending
Suppression lists and consent status are enforced automatically. An opt-out recorded on a channel blocks future sends on that channel, without relying on someone remembering to update a list.
Where we are today, stated plainly.
Security controls overview
We share a written summary of our security controls, data handling practices and sub-processor list on request, typically as part of your vendor security review or procurement process.
Download the security overview (2 pages) →SOC 2
We have not completed a SOC 2 audit yet. We share our timeline on request and do not imply a certification we do not hold.
Have a security questionnaire to complete?
Send it over and we'll walk your team through our controls and data handling directly.