Security

Your Data is Safe With Us

Enterprise-grade security built from the ground up. Ooh Marketing Limited (Company No. 16860604) protects your business data and your customers' information with industry-leading practices.

Protection

How We Keep You Secure

Encryption

TLS 1.3 for data in transit. AES-256 encryption for data at rest. Your messages are always protected.

Authentication

Multi-factor authentication, secure session management, and API key rotation. Powered by Clerk.

Infrastructure

UK-based servers (London), automated backups, firewall protection, and DDoS mitigation. 99.9% uptime SLA.

Monitoring

24/7 system monitoring, intrusion detection, real-time alerting, and comprehensive audit logs.

Application Security

Helmet.js security headers on all API responses

CORS policies restricting cross-origin requests

Input validation and sanitisation on all endpoints

Rate limiting to prevent brute force and DDoS attacks

SQL injection protection via Prisma ORM parameterised queries

Secure webhook verification for WhatsApp Business API callbacks

Role-based access control (Owner, Admin, Agent)

API key scoping — each integration uses least-privilege access

Infrastructure Security

UK-based data centre (DigitalOcean London) for data sovereignty

UFW firewall with strict port access control

SSH key-based authentication only — password login disabled

Automated daily database backups with point-in-time recovery

Process isolation with PM2 process manager

Nginx reverse proxy with request filtering

Regular system updates and security patches

Encrypted storage volumes for all customer data at rest

WhatsApp & Meta Platform Security

As a Meta Tech Provider integrating with the WhatsApp Business API, we implement additional controls to protect WhatsApp Business Solution data:

Secure webhook verification on all incoming WhatsApp API callbacks

WhatsApp Business Solution data is never used to build user profiles or for retargeting

WhatsApp data is never shared with or sold to third parties beyond authorised sub-processors

Per-organisation data isolation — no cross-contamination between business accounts

Meta system user tokens stored encrypted and rotated regularly

Two-factor authentication enforced on all Meta Business Manager accounts

AI & Data Processing Security

Customer messages processed through our AI pipeline are not used to train external models. We use OpenAI's API under a data processing agreement. Prompts sent to OpenAI are stripped of unnecessary identifying information where possible. Knowledge embeddings are stored per-organisation with strict isolation — no cross-contamination between business accounts.

Access Controls

We follow the principle of least privilege across our platform:

Role-based access control — Owner, Admin, and Agent roles with distinct permissions

Internal staff access to customer data is strictly limited and logged

All access to production systems requires MFA and SSH key authentication

Regular access reviews to remove stale permissions

Incident Response

We maintain a documented incident response plan that includes immediate containment and assessment, customer notification within 72 hours for data breaches, root cause analysis and remediation, post-incident review and process improvement, and ICO notification where required by UK GDPR.

Responsible Disclosure

If you discover a security vulnerability in Xpeak, we encourage responsible disclosure. Please email security@xpeak.io with details. We commit to:

Acknowledging your report within 24 hours

Providing a status update within 72 hours

Resolving critical vulnerabilities within 48 hours of confirmation

Crediting researchers who responsibly disclose issues (if desired)

Security Contact

For security-related questions or to report a vulnerability, contact us at security@xpeak.io.

Ooh Marketing Limited · Company No. 16860604
Flat 18 Eton House, Anglian Close, Watford, England, WD24 4RF