Security & Incident Policy

Remoxus uses layered technical and operational controls intended to reduce unauthorized access, data loss, abuse, and fraudulent activity.

Application Controls

Supported controls include password hashing, strict cookie-based sessions, secure and HTTP-only cookies on HTTPS, SameSite protection, session regeneration at authentication, CSRF protection, bot verification where configured, request rate limiting, tenant-scoped database queries, audit logging, suppression-list enforcement, and encryption of supported stored messaging credentials.

Account Security

Administrator accounts can use time-based one-time-password two-factor authentication. Sensitive actions such as account deletion require password re-authentication. Users remain responsible for strong unique passwords, safe devices, secure email accounts, restricted staff access, and prompt revocation of exposed provider credentials.

Webhook and Payment Safety

Webhook payloads are validated against known records and provider configuration where available. Payment activation must be based on a verified callback and an existing transaction, not merely a browser return page. Repeated callbacks are handled idempotently where supported.

Incident Response

When a suspected incident is identified, the operator may contain access, rotate credentials, disable integrations, preserve relevant logs, investigate scope, restore from protected backups, and notify affected users or authorities where required. Notification timing and content depend on verified facts and applicable law.

Reporting

Report suspected vulnerabilities, credential exposure, unauthorized account access, or personal-data misuse through Contact. For personal-data rights or unauthorized use of a phone number, use the Privacy Request page. Do not publicly disclose credentials or personal data in a report.

Limitations

No internet-connected service is immune from all risks. Security controls reduce risk but do not guarantee uninterrupted availability, successful message delivery, or prevention of every incident.