Specifics you can check, and a list of what is missing
Most security pages are a wall of reassuring nouns. This one names the algorithms, says where the boundary is enforced, and ends with the controls and certifications Rechlio does not have — because a security page that admits nothing tells you nothing about the judgement of the people who wrote it.
Passwords and sessions
| Password hashingA recommended key-derivation function, not a bare hash | scrypt |
|---|---|
| Salt16 random bytes, generated per password | Per password |
| ComparisonConstant-time, so a wrong password cannot be narrowed by timing | timingSafeEqual |
| Access tokenBearer token, never a cookie | JWT (HS256) |
| Refresh token at restOnly a hash is stored — the token itself is not in the database | Hashed |
Sessions are revocable, and recorded
Each session row carries an expiry, a revocation timestamp, and the user agent and IP it was created from. A session can be ended server-side rather than waiting for a token to expire.
On CSRF, and the trade it implies
Authentication is a bearer token in an Authorization header, never a cookie, and cross-origin requests send no credentials. A cross-site form or image post therefore cannot carry your token, so classic CSRF does not apply and a CSRF token would protect nothing.
The honest counterpart: a token in browser storage is reachable by any script that runs on the page, so the protection that matters becomes keeping such a script off it. That is what the headers below and the bundle checks are for.
Workspace isolation
Every row of customer data belongs to a workspace, and the boundary is enforced by Postgres row-level security — 46 tables with RLS enabled and 53 policies, applied as part of every deployment rather than configured by hand. The WhatsApp inbox, the automation rules, the API keys and the payment records were the last tables without one; they are covered now.
Why the enforcement point matters more than the rule
A filter written into every query is a filter that will eventually be missed in one, and the one it is missed in will be a new feature written under time pressure by somebody who did not know the convention. Enforcing it below the application means the failure mode of a mistake is a query that returns nothing, rather than a query that returns another customer’s leads.
Team access covers the three roles and how conversations are assigned within a workspace.
Your provider credentials
Connecting your own SMTP server, MSG91 account or other provider means handing Rechlio a credential. Those are encrypted at rest with AES-256-GCM — authenticated encryption, so a tampered ciphertext fails to decrypt rather than decrypting to something else.
A limitation the code documents against itself
The encryption key is derived from the configured secret with a plain, unsalted SHA-256 rather than a salted key-derivation function. That is weaker than it should be, and it is recorded as a known limitation in the source: changing it would change the derived key and make every value encrypted under the current scheme undecryptable, so it is kept deliberately rather than by oversight. The mitigation is a minimum length requirement on the secret itself, which the application warns about at boot if it is not met.
This is the kind of thing a security page normally omits. It is here because you would rather know.
Your WhatsApp Business account is different in kind: Rechlio is a Meta Tech Provider, so you connect your own account through Meta’s embedded signup and the number never belongs to us. What that means.
The audit log
Data access is logged: which workspace, which user, what action, which resource, the IP it came from, and a timestamp. India’s Digital Personal Data Protection Act expects it, and it is also what turns the isolation claim above from an assurance into something checkable after the fact.
The DPDP compliance page covers the obligations in full, including the Grievance Officer route and the response times committed to.
What the public pages can see
The business finder on this site runs without an account, which makes it the one place where a bug could expose something. Two properties keep it safe by construction rather than by care:
- It never reads the leads table. A customer’s prospect list is not reachable from any public route.
- The upstream request is field-masked to a business name and its address. No phone number, email address or website flows through the public path at all — not filtered out afterwards, never fetched.
Anonymous telemetry from public pages is separately constrained: it accepts only an allow-listed set of event names, never attaches a workspace whatever the caller sends, and records counts and shapes rather than anything typed into a search box.
Webhooks and the API surface
| Webhook verificationConstant-time comparison, so a signature cannot be brute-forced by timing | HMAC-SHA256 |
|---|---|
| Authenticated APIEvery /api route behind a JWT check | Bearer token |
| Automation APISeparate surface, keyed per workspace | Workspace API key |
| Rate limitingPer workspace when signed in, per IP when not | On every surface |
| Auth request body capBlunts memory-exhaustion attempts on the unauthenticated surface | 64 KB |
| Allowed originsAn explicit allowlist, not a wildcard | CORS allowlist |
Deployment carries its own check: continuous integration scans everything the browser bundle ships for the values of every variable marked secret — searching for values rather than names, because a build inlines a secret and discards the variable name along the way.
Browser-level protections
- X-Frame-Options: DENY — the app cannot be framed, so it cannot be clickjacked.
- X-Content-Type-Options: nosniff — no MIME sniffing.
- Strict-Transport-Security — one year, including subdomains.
- Referrer-Policy: strict-origin-when-cross-origin — a token in a URL cannot leak through a Referer header.
- X-DNS-Prefetch-Control: off, and no
X-Powered-By.
What the AI cannot do
An AI agent that can search your leads, draft a pitch and launch a campaign is an AI that can spend your money while you are in a meeting. Seven actions are classed as consequential — including the one that debits your wallet and calls Meta — and asking for one produces a proposal rather than an effect. Five conditions must all hold before it executes — right workspace, right person, still pending, not expired after fifteen minutes, and the SHA-256 hash of the arguments still matching.
That last one is the condition that matters: without it, approving a message to ten contacts could be redeemed for a message to ten thousand. The gate in full.
What Rechlio does not have
- No SOC 2, no ISO 27001, and no audit in progress. If either is a hard requirement, this is not a fit today.
- No third-party penetration test to publish. Anything claimed here is a description of the code, not the finding of an external assessor.
- No SAML, no SCIM, no directory provisioning. Sign-in is Google or an email and password.
- No customer-managed encryption keys, and no bring-your-own-key.
- No published uptime SLA, and no status page.
- No bug bounty programme — though a report is still welcome, and the route is below.
- No Content-Security-Policy on the web app yet. The security headers above are real; this specific one is a gap and is named rather than glossed over.
- The key-derivation limitation described above, which is a genuine weakness kept for a stated compatibility reason.
A list like this costs enquiries. It is here because the alternative — discovering a gap during a security review after signing — costs more, for both of us.
Reporting a vulnerability
Email support@rechlio.com with enough detail to reproduce it. There is no bounty programme and no formal disclosure timetable to promise — Rechlio is a small company and inventing a policy it cannot staff would be worse than saying so.
What is committed: a report will be read by a person, acknowledged, and acted on in proportion to what it shows. Please do not test against other customers’ data or run automated scanning that would affect service for anyone else.
Questions
- Is Rechlio SOC 2 or ISO 27001 certified?
- No. Neither, and no audit is in progress. If a certification is a hard requirement for your procurement process, Rechlio does not meet it today and saying so now saves us both a call. What this page offers instead is specifics you can check rather than a logo you have to trust.
- Can another Rechlio customer see my leads?
- No, and the reason is worth being specific about: the boundary is enforced by Postgres row-level security rather than by every query remembering to filter. A filter that has to be written into each query will eventually be missed in one, and the one it is missed in will be a feature written under time pressure. Enforcing it underneath means the failure mode is a query returning nothing rather than a query returning somebody else’s customers.
- Where are my WhatsApp conversations stored?
- In Rechlio’s database, scoped to your workspace. Your WhatsApp Business account and phone number stay on your own Meta account — Rechlio is a Meta Tech Provider and never owns the number — so if you leave, the number and its quality rating remain yours. The conversation history stored here does not move with it, which is worth knowing before any migration in either direction.
- How do I delete everything?
- The data deletion page describes the process for an account, a workspace, and connected WhatsApp and Meta data. Deletion cascades: workspace rows carry a foreign key with
on delete cascade, so removing a workspace removes its leads, conversations, campaigns and audit entries rather than orphaning them.