Trust & security
Your data, handled with care
We’re a small team that treats your subscriber list like our own. Here’s exactly how ReachBell protects data, who we share it with, and how to reach us about security.
How we protect your data
GDPR & DPDP aligned
Built privacy-first to support the EU GDPR and India’s DPDP Act. Subscribers manage consent through a hosted preference center, and consent events are recorded.
Encrypted at rest
Sensitive data is encrypted at rest. Provider credentials you upload (FCM, APNs, SMTP) are encrypted with keys held by you, not shared across tenants.
90-day audit log
Every administrative action is captured in an audit log retained for 90 days, with viewer-only roles available on higher plans for least-privilege access.
Consent & preference center
A hosted, one-click preference center lets your subscribers manage channels or unsubscribe — so opt-outs are honoured automatically across push and email.
Reliable delivery
Sends are queued, retried, and idempotent so a transient provider hiccup never double-sends or silently drops. We target 99.9% delivery-pipeline uptime.
India data residency
Primary infrastructure runs on AWS in the Mumbai (ap-south-1) region. Tell us if you have a specific residency requirement and we’ll walk you through our setup.
Sub-processors
We use a small set of trusted providers to deliver the service. We keep this list current — see the full sub-processor list and our Data Processing Agreement.
| Provider | Purpose | Region |
|---|---|---|
| Amazon Web Services (AWS) | Cloud hosting, database, email (SES), file storage (S3) | India (Mumbai) + other regions per deployment |
| MongoDB Atlas | Managed database hosting | India / as configured |
| Cashfree Payments | Billing, invoicing, UPI & card payments | India |
| Google (Firebase Cloud Messaging) | Android & web push delivery | Global |
| Apple (APNs) | iOS push delivery | Global |
| Meta Platforms (WhatsApp Cloud API) | WhatsApp message delivery | Global |
| SMS provider (customer-configured, e.g. Gupshup / MSG91 / Twilio) | SMS delivery, when SMS is enabled | Varies by provider |
| Sentry | Error monitoring & diagnostics (when enabled) | EU / US |
| Crisp | Live-chat support widget on the marketing website | EU |
Data Processing Agreement
Need a signed DPA before you onboard? We’ll send one over — email sale@reachbell.com.
Report a vulnerability
Found something? Responsible disclosures to security@reachbell.com are acknowledged within 24 hours.
On our roadmap
We’re not SOC 2 certified yet — we’d rather say so than imply otherwise. Formal certification and a public status page are planned as we grow.