Privacy and security
Security and vulnerability reporting
This page describes documented security controls at a level that is useful to customers without publishing details that could weaken security. The controls reduce risk but are not a certification, SLA or guarantee against incidents.
Controls currently in use
Privileged administrative access is protected by multi-factor authentication, and remote administration of the production environment takes place through a VPN. Access is granted according to need and can be attributed to authorised users. Production and staging environments are separated for customer content. Core infrastructure and backups are located with AWS in Ireland.
Connections and integrations
The public website, customer portal, supported REST v2 API endpoints and supported callbacks use HTTPS for data in transit. The supported REST v2 authentication flow uses OAuth 2.0. Customers must protect credentials and follow the current integration requirements. Messaging-channel transport and downstream provider controls vary by channel and route. This is not a statement that SMS, standard email or voice delivery is end-to-end encrypted or that every data item is encrypted in the same way in every system.
Customer account security
The customer must protect passwords, API credentials and other access information, restrict access according to need, and remove access when no longer required. Secrets must not be placed in public client code or shared through insecure channels. Suspected misuse must be reported to info@intellipush.com as soon as possible.
Messaging channels
Ordinary SMS and standard email are not end-to-end encrypted, and message content may be visible to anyone with access to the receiving device or account. Voice messages may be heard by anyone with access to the receiving telephone or voicemail. Avoid sensitive personal data, complete credentials and other confidential content in the message itself. Use neutral wording and an appropriate authenticated service where the content requires stronger protection.
Files shared by link
Where a customer uses a feature that shares a file by link, the file is public to anyone who has the link. The link has high entropy, is not listed in a public directory and is configured not to be indexed. The customer can revoke or delete the file. Do not use this model for secret, sensitive or high-risk content without a separate assessment.
Temporary files and backups
Temporary import files are automatically deleted within seven days. Production backups expire through a 14-day cycle. Backup is a resilience control, not a customer-accessible archive. Planned restore and re-deletion exercises form part of the improvement programme and must not be understood as an already guaranteed public control.
Testing and follow-up
An external penetration test was completed in April 2026 after a security-hardening phase. Remediation work is prioritised according to risk and remains part of the security improvement programme. This describes one completed test and does not imply certification, continuous testing, a fixed future frequency or the absence of vulnerabilities.
Abuse and messaging security
The platform has blacklists, suppression following opt-out and campaign limits that help reduce abuse. We may investigate complaints and unusual activity and restrict or suspend use under the terms. Identifiable recipient data from customer campaigns is not reused for Intellipush's own marketing; non-identifying aggregated service statistics may be used for operations and improvement.
Incidents and personal-data breaches
Potential incidents are assessed according to severity and affected data. We work to contain harm, preserve necessary records, address causes, and notify customers or authorities where the agreement or law requires it. We do not promise 24/7 staffing or a specific public response time unless this is set out in a separate agreement.
Report a potential vulnerability
Send a concise description to info@intellipush.com with the subject “Security”. State the affected service, method and potential impact without unnecessary personal data. Do not extract data, alter another person's information, disrupt the service, use social engineering or publish details before the matter has been assessed.
Improvement programme
The security programme is reviewed at least annually and following material changes. Priorities include multi-factor authentication for customer accounts, regular restore and re-deletion exercises, stricter callback-destination restrictions, more granular country and use controls, and additional automated abuse protection. These are directions of work, not promises of a feature, date or contracted service level.
Last fact-checked: · Responsible function: Intellipush Management