Tenant isolation
Every org-scoped API resolves membership and role before touching data. Cross-tenant access is treated as a defect, covered by IDOR tests.
Security
Controls you can reason about.
We describe the architecture that shapes Sendaro today. We do not invent SOC 2 seals, ISO badges, or customer logos.
Append-only audit logs
Admin credit adjustments, abuse actions, and sensitive configuration changes write immutable audit entries with actor and reason.
Encrypted provider secrets
Provider and billing credentials are encrypted at rest. Application code never logs raw secrets or ships them to the browser.
Webhook signature verification
Inbound email and billing webhooks verify signatures before mutating subscriptions, credits, or delivery state.
Durable, idempotent jobs
Sends and side effects run in workers with idempotency keys so retries cannot double-charge credits or double-send.
Abuse & compliance signals
Conservative admin actions (throttle, suppress, investigate) are preferred over silent reputation gaming.
Placeholders, labeled on purpose.
Third-party reports and customer references will appear here when they are real. Until then, expect dashed placeholders — never fabricated seals.
SOC 2 report — pending
Penetration test — pending
Customer references — pending