Security

1. How we protect data

• Encryption in transit. The website, dashboard and API are HTTPS only (HSTS). SMTP submission requires TLS 1.2 or newer, and outgoing mail is encrypted whenever the receiving server supports it, or always for domains set to enforced TLS.
• Encryption at rest. The database and its local backups live on an encrypted volume (LUKS2, AES-256). Signing keys, webhook secrets and store credentials are additionally sealed with AES-256-GCM; API keys and session tokens are stored only as digests and passwords with argon2id.
• Encrypted off-site backups. Nightly backups are encrypted before they leave the server, with a key that is kept offline and never stored on our servers, and are kept for 35 days. We test a full restore every month.
• Access logging. Every read, export or deletion of contacts, store customers and orders, and message recipients is recorded in an append-only log with who, what, when and from where, kept for one year. Organization owners and admins can review it in the dashboard under Settings → Security.
• Least privilege. Team roles (owner, admin, member), sending-only and domain-restricted API keys, and read-only access to store platforms. Production is reachable only by our operator, with personal SSH keys (no passwords, no shared accounts), and secrets are kept in a password vault, never in code.
• No personal data in logs. Application logs never contain email addresses, request bodies or query values.
• Retention. Message content is deleted automatically after a short period, and data from a store is erased when the store or the customer asks for it through the platform’s privacy requests.

2. Incident response

We follow a written incident response policy with severity levels, containment and recovery steps, and a post-mortem for every serious incident.

If we confirm a breach that affects your data, we notify you without undue delay and within 72 hours, so you can meet your own obligations; we notify Brazil’s data protection authority (ANPD) and, where the GDPR applies, the competent authority, as the law requires. When store data from Shopify or Nuvemshop is involved, we also notify the platform.

Questions about data protection: privacy@pidgely.com.

3. Reporting a vulnerability

Email security@pidgely.com with a description, the steps to reproduce and the impact you expect. Please:

• give us a reasonable time to fix the issue before disclosing it;
• do not access, modify or delete data that is not yours, and stop as soon as you reach someone else’s data;
• do not degrade the service (no denial of service, no spam, no social engineering of our team).

We will not take legal action against research done in good faith within these rules. We acknowledge reports quickly, keep you informed and credit researchers who want it. Our contact is also published in /.well-known/security.txt.