One business cannot reach another
Every row of data carries the workspace it belongs to, and the database refuses a read from outside it. This is not a check in our code that could be forgotten on one screen — it is enforced underneath, which is the core of how the service is built.
Credentials
The access tokens for each channel you connect, and the app passwords for each mailbox, are encrypted by us before they are stored, with the key held outside the database. They are never shown back in full. Your own password is held only as a salted hash by our authentication provider; we never see it. We do not ask for payment card details at all — Paddle handles those and we never see a card number.
In transit, and at rest
HTTPS and TLS everywhere, with HSTS. Storage is encrypted by our hosting provider, and point-in-time backups are taken and tested so data can be recovered after an incident.
Who can get in
Administrative access to production is limited to the people who need it, behind multi-factor authentication, and is logged. Service credentials live in the hosting platform's secret store rather than in our code. Incoming webhooks from the platforms you connect are verified by signature, compared in constant time.
If something goes wrong
If there is a breach affecting your data we will tell you within 48 hours of becoming aware of it — not after an investigation finishes — with what happened, who is affected, and what we are doing. The full commitment is in our data processing agreement.
What we do not have
Semaji holds no SOC 2 report and no ISO 27001 certification, and we do not claim either. If you need one before you can use us, write to us and we will tell you honestly where we are rather than sell you a plan you cannot deploy.
Telling us about a problem
If you believe you have found a vulnerability, write to support@semaji.com with enough detail to reproduce it. We will acknowledge you, keep you posted, and we will not pursue anyone who reports in good faith and does not access other people's data.