Security controls overview
1.What Cast handles
Cast handles OTPs, payment alerts and customer conversations for teams in telecoms, fintech and retail. Encryption, access control and local compliance are built into how the platform works, not added on afterward.
2.Controls at a glance
- Encrypted in transit
- Credentials encrypted at rest
- Role-based access
- Per-tenant data isolation
- GDPR and POPIA aligned
- Public status page and defined incident communication for enterprise agreements
3.Data handling
Encrypted in transit
The Cast console, API and webhooks are available over TLS, and that is how the product and our documented integrations connect. Nothing you send us, or we send you, has to travel in the clear.
Credentials encrypted at rest
Channel credentials and secrets, such as WhatsApp tokens, SMTP passwords, SSO client secrets and payment provider keys, are individually encrypted at rest with AES-256. API keys and account recovery codes are stored hashed, not in plain text. Message content and contact records in the database are not separately encrypted at rest today.
Tenant isolation
Every account's data is scoped to that account. Automated tests check the contact, group, dealer and import paths.
4.Access controls and auditability
Invite teammates with the exact permissions their job needs, from a read-only viewer to an owner. Every sensitive action is written to an audit log you can review, and the log is append-only: the application cannot edit or delete audit rows. OpenID Connect and SAML 2.0 single sign-on, SCIM provisioning and TOTP multi-factor authentication are built; we verify single sign-on against your identity provider during setup.
5.Privacy and data processing
Our privacy program follows the principles of GDPR (EU/UK) and POPIA (South Africa): lawful basis for processing, data minimisation, and retention windows you set per account. The configurable retention engine is rolling out and is off until it is enabled for an account; our privacy policy lists the defaults and says which categories are not yet on an enforced schedule.
A data processing agreement (DPA) is in preparation with counsel and is not yet available. Ask us for the current status before any EU or UK personal data is processed.
We don't sell or share your customers' data with third parties for their own marketing. It's used to send and support the messages you ask us to send, and nothing else.
6.Reliability and transparency
Message delivery, journey execution and webhook dispatch run as background processors that each report a heartbeat, and we are alerted by email when one goes silent.
A public status page shows component-level health for the API, messaging channels, inbox and dashboard, at cast.wayvzgroup.com/status.
If something breaks on our side, we tell you, rather than waiting for you to open a ticket. Enterprise agreements carry defined incident-communication and response terms.
7.Messaging compliance
Sender ID formats, registration and content rules vary by country. We apply them for each market you send into.
STOP and HELP keywords are recognised automatically on SMS and WhatsApp, and honoured on every future send on that channel, not just the campaign it arrived on.
Across MENA and Africa we apply each market's sender-registration and know-your-customer rules through the local operators we route with, before a new sender goes live.
Suppression lists and consent status are enforced automatically at send time, on every campaign. An opt-out recorded on a channel blocks future sends on that channel, without relying on someone remembering to update a list. Opt-out is held per channel, so someone who stops SMS is not silently unsubscribed from WhatsApp as well.
8.Hosting location
Cast runs on a single dedicated server hosted by Hetzner in Germany (EU). Application and database infrastructure is located in that one region today; other regions are not available yet.
9.Sub-processors
The current sub-processor list is published in our privacy policy.
10.Certifications
We have not completed a SOC 2 audit yet. We share our timeline on request and do not imply a certification we do not hold.