01
Encryption in transit
TLS 1.2+ on every endpoint. WSS for WebSocket. Token-based auth on every connection. No clear-text inside data centres.
Security & trust
Security and operational controls Indian buyers actually ask about
Tody is built with realistic enterprise expectations in mind: encryption in transit, hashed credentials, India data residency, signed webhooks, audit logging, and policies for abuse, suspension, and recovery.
Pillars
Four pillars of the Tody security posture
We focus on what production buyers care about: where data lives, how it’s protected, who can do what, and how you prove it later. No marketing fog — just the operational realities.
02
Credential hygiene
Bcrypt password hashing. API keys stored hashed, shown once. No customer secrets in logs. Key rotation supported.
03
India residency
Data hosted in Indian data centres. Backups stay in India. Cross-border movement is opt-in per integration.
04
Audit & governance
Template changes, campaigns, wallet ledger, API key issuance, and admin actions are all logged with exportable trails.
Controls
Operational controls baked into the platform
Each control below is built into the platform — not a roadmap promise. We list real limits and real behaviour so your security team can validate quickly.
Rate limiting
Default 60 req/min on sandbox keys. Production keys are sized per customer. Burst limits configurable.
Account suspension
Programmatic suspension blocks all sending. Business status is checked before every API call.
Template approval
All templates pass through review. Variables are typed. Rejected templates cannot be used in production.
Idempotency
Idempotency keys eliminate duplicate sends. Replay-safe within 24 hours.
Signed webhooks
HMAC-SHA256 signatures on every webhook payload. Verify with your shared secret to prevent spoofing.
Wallet ledger
Double-entry accounting on every debit and credit. Export CSV for finance reconciliation.
Incident response
What happens when something goes wrong
We’ve documented the response process for security events, abuse reports, suspected key compromise, and account takeover. Customers on enterprise plans get a named incident point of contact and a 1-hour acknowledgement window.
- Email security@tody.in for any suspected vulnerability
- Immediate rotation path for compromised API keys
- Account-takeover recovery via verified email + admin review
- Post-incident summary for customer-facing impact
Security FAQ
Questions security teams ask before they sign
If your team needs additional detail for a formal review, email security@tody.in — we share what we can after a brief verification.
All Tody traffic is encrypted in transit via TLS 1.2 or higher. WebSocket connections use WSS with token authentication. Internal service-to-service calls are restricted to the private network and require signed requests.
User passwords are hashed using bcrypt with per-user salts. API keys are stored hashed; only a one-time display lets you copy a new key. Customer secrets are never logged in clear-text.
Tody data is hosted on Indian data centres with Indian data residency. We do not move customer content outside India unless explicitly required by a customer-side integration.
Suspicious accounts can be rate-limited or suspended programmatically. The Business API includes account-status checks before any send, so a suspended business cannot continue sending.
Yes. Tody logs template changes, campaign creation, wallet movements, API key issuance, login events, and admin actions. Logs are exportable on enterprise plans.
Take Tody through your security review
We’ll respond to your questionnaire, schedule a technical walk-through, and share architecture diagrams under NDA.