Security Architecture & UK GDPR Compliance
SiSender is engineered to meet the stringent security, data isolation, and audit requirements of regulated UK and European enterprises.
Multi-Tenant Data Isolation
Every HTTP request passes through CodeIgniter 4's outreachTenant filter. All database queries enforce organization scoping via non-sequential hexId identifiers, completely mitigating Insecure Direct Object Reference (IDOR) vulnerabilities.
TOTP Two-Factor Auth (2FA)
Protect operator accounts with standard RFC 6238 time-based one-time passwords (TOTP). Compatible with Google Authenticator, 1Password, and YubiKey. Emergency backup codes are generated and hashed upon activation.
Tamper-Evident Activity Logs
Every security-sensitive action — user invitations, role changes, CSV exports, campaign activations, and mailbox deletions — is recorded to an immutable activity log with actor ID, timestamp, and client IP address.
UK GDPR & PECR Alignment
B2B marketing operations comply with Privacy and Electronic Communications Regulations (PECR). Every outbound message supports automated one-click unsubscribe headers (RFC 8058) and permanent suppression lists.
SHA-256 Hashed API Tokens
Developer REST API tokens are hashed using one-way SHA-256 before insertion into the database. Plaintext tokens are displayed exactly once to the developer and are never retrievable by administrators or engineers.
Zero Stored Passwords (OAuth 2.0)
Google Workspace accounts connect using modern OAuth 2.0 PKCE protocol. User passwords are never entered or stored within SiSender; the engine operates solely on revocable refresh tokens.