Security is a feature, not a checklist.
Blendwave carries your customers' conversations, so every control has to be specific, testable, and honest about its scope.
Tenant boundaries
Application requests are scoped to the authenticated workspace and tenant. Public-schema tables have row-level security enabled as defense in depth; the direct database role bypasses those policies, so authorization remains explicit in server code.
Encryption
HTTPS protects traffic in transit. Connected-account credentials handled by the integration credential service are encrypted with AES-256-GCM before storage. Ask for current environment evidence before treating either statement as a contractual control.
Audit trail
Audited operator workflows write structured events to a hash-chained activity log. Ask for the current event-coverage matrix before relying on it for a control requirement.
Authentication
Supabase Auth supports password and email-link sign-in. TOTP two-factor can be required for owners and admins. Blendwave adds connection-scoped shared throttling when the required protection service is configured; provider-side authentication protections remain separately configured and environment-specific.
Webhook integrity
Supported Telnyx and Resend webhooks verify provider signatures. Blendwave-generated webhooks use HMAC-SHA256 signatures you can verify.
Your data stays yours
Workspace admins can request export or deletion. Blendwave does not use customer conversations to train a shared Blendwave model.
Current assurance scope
This page describes controls represented in the current product source and intended infrastructure. It is not proof that every control is enabled in every deployed environment. Blendwave does not claim a formal security certification today. Contact us for current environment-specific evidence or a security questionnaire.
Coordinated disclosure
Found a security issue? Email security@blendwave.ai with the steps to reproduce and your contact info. We prioritize credible reports by severity and credit reporters in the release notes when they opt in.