Most security pages are a wall of reassuring nouns. This one names the algorithms, says where the boundary is enforced, and ends with the controls and certifications Rechlio does not have — because a security page that admits nothing tells you nothing about the judgement of the people who wrote it.
| Password hashingA recommended key-derivation function, not a bare hash | scrypt |
|---|---|
| Salt16 random bytes, generated per password | Per password |
| ComparisonConstant-time, so a wrong password cannot be narrowed by timing | timingSafeEqual |
| Access tokenBearer token, never a cookie | JWT (HS256) |
| Refresh token at restOnly a hash is stored — the token itself is not in the database | Hashed |
Each session row carries an expiry, a revocation timestamp, and the user agent and IP it was created from. A session can be ended server-side rather than waiting for a token to expire.
Authentication is a bearer token in an Authorization header, never a cookie, and cross-origin requests send no credentials. A cross-site form or image post therefore cannot carry your token, so classic CSRF does not apply and a CSRF token would protect nothing.
The honest counterpart: a token in browser storage is reachable by any script that runs on the page, so the protection that matters becomes keeping such a script off it. That is what the headers below and the bundle checks are for.
Every row of customer data belongs to a workspace, and the boundary is enforced by Postgres row-level security. The policy script defines protection for 126 tables with 150 policies, including agency hierarchy, client-controlled handoffs, client-approved template rollouts, workspace retention, WhatsApp and Instagram conversations, consented channel handoffs, team notes and labels, approval history, automation history and workflow email/SMS delivery evidence, API keys and payments. Deployment operators must apply and verify these policies and database-role permissions; the source definitions alone do not establish that a deployment is protected.
A filter written into every query is a filter that will eventually be missed in one, and the one it is missed in will be a new feature written under time pressure by somebody who did not know the convention. Enforcing it below the application means the failure mode of a mistake is a query that returns nothing, rather than a query that returns another customer’s leads.
Team access covers the three roles and how conversations are assigned within a workspace.
Connecting your own SMTP server, MSG91 account or other provider means handing Rechlio a credential. Those are encrypted at rest with AES-256-GCM — authenticated encryption, so a tampered ciphertext fails to decrypt rather than decrypting to something else.
The encryption key is derived from the configured secret with a plain, unsalted SHA-256 rather than a salted key-derivation function. That is weaker than it should be, and it is recorded as a known limitation in the source: changing it would change the derived key and make every value encrypted under the current scheme undecryptable, so it is kept deliberately rather than by oversight. The mitigation is a minimum length requirement on the secret itself, which the application warns about at boot if it is not met.
This is the kind of thing a security page normally omits. It is here because you would rather know.
Your WhatsApp Business account is different in kind: Rechlio is a Meta Tech Provider, so you connect your own account through Meta’s embedded signup and the number never belongs to us. What that means.
Data access is logged: which workspace, which user, what action, which resource, the IP it came from, and a timestamp. India’s Digital Personal Data Protection Act expects it, and it is also what turns the isolation claim above from an assurance into something checkable after the fact.
The DPDP compliance page covers the obligations in full, including the Grievance Officer route and the response times committed to.
The business finder on this site runs without an account, which makes it the one place where a bug could expose something. Two properties keep it safe by construction rather than by care:
Anonymous telemetry from public pages is separately constrained: it accepts only an allow-listed set of event names, never attaches a workspace whatever the caller sends, and records counts and shapes rather than anything typed into a search box.
| Webhook verificationConstant-time comparison, so a signature cannot be brute-forced by timing | HMAC-SHA256 |
|---|---|
| Authenticated APIEvery /api route behind a JWT check | Bearer token |
| Automation APISeparate surface, keyed per workspace | Workspace API key |
| Rate limitingPer workspace when signed in, per IP when not | On every surface |
| Auth request body capBlunts memory-exhaustion attempts on the unauthenticated surface | 64 KB |
| Allowed originsAn explicit allowlist, not a wildcard | CORS allowlist |
Deployment carries its own check: continuous integration scans everything the browser bundle ships for the values of every variable marked secret — searching for values rather than names, because a build inlines a secret and discards the variable name along the way.
X-Powered-By.An AI agent that can search your leads, draft a pitch and launch a campaign is an AI that can spend your money while you are in a meeting. Eight actions are classed as consequential — including actions that debit your wallet or call Meta — and asking for one produces a proposal rather than an effect. Eight conditions must all hold before it executes: right workspace, intended person, current membership, pending status, expiry after fifteen minutes, the SHA-256 payload hash, a still-classified executable tool, and an unchanged target snapshot.
That last one is the condition that matters: without it, approving a message to ten contacts could be redeemed for a message to ten thousand. The gate in full.
A list like this costs enquiries. It is here because the alternative — discovering a gap during a security review after signing — costs more, for both of us.
Email support@rechlio.com with enough detail to reproduce it. There is no bounty programme and no formal disclosure timetable to promise — Rechlio is a small company and inventing a policy it cannot staff would be worse than saying so.
What is committed: a report will be read by a person, acknowledged, and acted on in proportion to what it shows. Please do not test against other customers’ data or run automated scanning that would affect service for anyone else.
on delete cascade, so removing a workspace removes its leads, conversations, campaigns and audit entries rather than orphaning them.