Security and data handling

Transport

All API traffic runs over HTTPS. Register your inbound webhook on an HTTPS URL with a valid certificate.

Each inbound webhook delivery carries the headers you registered on the workspace with the URL. There is no signature header, so register a secret header of your own, such as x-webhook-secret, and reject any delivery that does not carry it. Keep the secret out of the URL. The setup is in inbound webhooks.

Authentication

Your app gets an OAuth access token and a refresh token when a Blue Reacher user installs it. The access token lasts 24 hours and the refresh token one year. Store both server-side, keyed by the installing user, and never in browser or mobile client code or in a repository. Refresh on a 401. Each token is bound to the user who installed your app and to the scopes they approved, so a leaked token cannot read another account's data. Blue Reacher can revoke an installation at any time, and every token for it stops working at once. Details are in authentication.

What data we hold

Running the service requires holding the contents of the conversations you send and receive: contact phone numbers and any contact fields you supply, message bodies and media, delivery and read status, opt-out records with their evidence, and line configuration. Request metadata, including timestamps, endpoints, status codes, and trace IDs, is retained for operations and support.

Retention and deletion

Message and contact data persists for the life of your workspace so your conversation history stays intact. DELETE /v1/contacts/{id} soft-deletes a contact: it stops appearing in the API and the app, and its id answers 404 from then on. Contact support if you need a contact removed permanently.

Keep your opt-out records in your own system. Don't rely on them surviving when a contact is deleted here, because re-importing a list could bring back someone who asked you to stop. The compliance guide covers the five-year retention of do-not-call requests.

On account closure, workspace data is deleted after a window during which an export can be requested.

Your own retention obligations

Compliance record-keeping is yours, not ours, and it outlives your account. Export consent records, message history, and revocation evidence into your own system on a schedule rather than treating the platform as the archive of record. The five-year retention target and the specific items to keep are listed in the compliance guide.

Subprocessors

Blue Reacher runs on infrastructure providers for hosting, database, storage, and messaging delivery, and uses standard operational tooling for error monitoring and support. The current subprocessor list, with each provider's role and processing location, is available on request and is provided as an appendix to the data processing agreement. Contact support for the current version rather than relying on a page that could go stale between reviews.

Data processing agreement

A DPA is available for customers who need one, including standard contractual clauses where the transfer requires them. Request it through support.

What we do not do

We do not sell customer data. We do not use the contents of your conversations to build or train models. We do not share your contact lists between workspaces. Lines are dedicated per workspace, so your sending is not pooled with another customer's traffic, which is both a security property and the deliverability property described in Apple and iMessage.

For a security review

Reviewers usually want the same five things. Send them: this page, the authentication page for credential handling, the inbound webhooks page for how deliveries are authenticated, the compliance guide for consent and retention practice, and the DPA with its subprocessor appendix from support. Anything they ask for beyond that, send it to us directly and we will answer it rather than have you guess.