What we protect today, without the gloss.
Where your data lives, how we back it up, who can access what and what we don't have. Updated October 14, 2026.
Data in São Paulo
The production base is in São Paulo, Brazil. The exceptions are AI, Meta (WhatsApp and Instagram), push and Cloudflare (DNS, the website proxy and voice call relay), listed below.
Daily, with an immutable copy
Every day a copy of the database goes to a vault in São Paulo, encrypted and locked: until the retention period ends, nobody can alter or delete it. The last full restore drill was on October 5, 2026.
9 roles
Each person only sees what their role allows. Your company gives 7 of them to the people it invites; the owner role stays with whoever created the account, and the support role is reserved for the CCX team.
Audit trail
Invitations, role changes, exports, API keys and other admin actions are logged with author and time. People with permission review them in the dashboard, and CCX support entering your account is logged too.
What protects your data today.
Everything on this list is running in production. What doesn't exist is spelled out further down.
Encryption in transit and at rest
The dashboard and the API only answer over HTTPS. The database disk and the backups are encrypted, and webhook secrets and SMPP passwords are stored encrypted with AES-256-GCM.
15-minute sessions
Dashboard access lasts 15 minutes and renews on its own while you work. Signing out, changing your password or being suspended or removed from the organization ends the session at once, and no session lasts more than 30 days.
Nine access roles
From owner to read-only, each person gets the minimum they need for their work.
Passwords and MFA
Passwords stored with Argon2id. MFA with an authenticator app: each person turns it on in their account, and the organization can require it for everyone.
Scoped API keys
Each key declares what it can do, and nobody can create a key more powerful than they are. It's shown only once and stored only as a hash.
Signed webhooks
Every webhook CCX sends carries an HMAC-SHA256 signature with a timestamp, so your system can check where it came from.
No long-lived cloud keys
Our applications don't store AWS access keys: each one gets temporary credentials, tied to that application.
Audit trail
Administrative actions in the dashboard are logged with who did them and when.
Backups we've actually restored.
Every day a copy of the database goes to a vault in São Paulo, encrypted with its own key and locked against deletion: until the retention period ends, nobody can delete it, not even our own applications.
On October 5, 2026 we restored the entire database from that vault as a drill, with no failures. And if the day's copy doesn't arrive, an external monitor alerts the team.
Who processes data with us, and where.
São Paulo is the default. The exceptions are declared below.
You're the controller. We're the processor.
Your customers' data is yours. We process it on your behalf, to deliver the service you signed up for.
Questions and requests about personal data go to our data protection officer: dpo@ccxmessages.com
Roles and audit, in the dashboard.
Who can do what, and the record of what was done.
What we don't have.
Said plainly, so your security review doesn't have to find it.
Certifications
CCX has no ISO 27001 certification and no SOC 2 report. If that changes, this page will say so, with the date and the report.
Responsible disclosure
Found a flaw? Write to our security channel. We acknowledge receipt within 5 business days and keep you posted until the fix. We don't take legal action against good-faith research that follows the policy.
Status
We don't publish availability or incident history. The status page shows what the platform is made of and a health endpoint your monitor can check.
What legal and IT ask us
Send your security questionnaire and we'll answer with what's live today.
Where is the data hosted?
In São Paulo, Brazil: application, database in three replicas, files, cache, queue, email sending and backups. The declared exceptions are delivery through Meta on WhatsApp and Instagram, AI processing in the United States, push notifications through Apple, Google and browsers, and Cloudflare's network for DNS, the website proxy and call audio relay. Each one is in the subprocessor list on this page.
Does CCX have ISO 27001 or SOC 2?
No. CCX has no ISO 27001 certification and no SOC 2 report. This page lists what protects your data today, and it will only mention a certification once one exists.
Is it end-to-end encrypted?
No. Messages are encrypted in transit and at rest, and the platform reads them to deliver, store and show them in your inbox. When CCX support needs to enter your account, the access requires a written reason and is recorded in your audit log.
Does the AI learn from my conversations?
No. CCX doesn't train models on your conversations, and your knowledge base is only used for the AI to look up context when it answers. How the AI subprocessors use and retain the content is set out in the Privacy Policy.
What happens when I leave?
You give 30 days' notice, with no termination fee, and export whatever you need before you go.
How do I send my company's security questionnaire?
Send it to comercial@ccxmessages.com or talk to sales. We'll answer with what's live today and say clearly what we don't have.
Any security questions left?
Sign up through the site and get a US$5 test credit.