How your data is protected
A plain-language look at encryption, account isolation, payment security, and access controls. For the full legal terms, see our Privacy Policy.
Updated
Encryption in transit & at rest
Every connection to MsgHealth — the dashboard, your public booking page, your digital card, API calls — is encrypted in transit over TLS. Your data at rest is stored in a managed database that encrypts data at rest by default.
Some fields need a stronger guarantee than database-level encryption alone: worker Social Security and Tax ID numbers used for 1099/W-2 filing in the Accountant tools are additionally encrypted with AES-256-GCM before they're ever written to the database, using a key that's separate from database access itself. That means even a raw database read can't recover those values without the encryption key.
Account & data isolation
MsgHealth is multi-tenant — many businesses share the same underlying infrastructure, and keeping each account's data walled off from every other account is foundational, not an afterthought. Every API request is authenticated first, then every database query for your clients, bookings, messages, and other business data is scoped to your account's own ID before it runs. Sensitive tables also have Row-Level Security (RLS) policies defined at the database level as an additional backstop.
Payment & webhook security
We never store your clients' full card numbers — payments run through a PCI-compliant payment processor, and MsgHealth only ever sees a tokenized reference to a payment method, never the raw card number.
Every webhook MsgHealth receives from a third party — payment events, call and SMS events, email delivery events — is verified using that provider's cryptographic signature before it's trusted. A request claiming to come from one of our providers that doesn't carry a valid signature is rejected outright.
Access control & monitoring
Sign-in uses email/password or phone-based one-time passcodes. Login and OTP endpoints are rate-limited to slow down automated guessing, and OTP verification specifically fails closed under unusual conditions rather than silently allowing extra attempts through.
Enterprise accounts get Audit Logs, which record sign-ins, settings changes, data exports, and team/role changes so you have a record of who did what and when. We don't currently offer account-level two-factor authentication (2FA) beyond phone OTP for verification flows — full 2FA for every sign-in is on our roadmap.
Have a security question we didn't cover?
Reach out below and our team will get back to you directly.
Security questions
Do you store my clients' credit card numbers?
No — payments are processed by a PCI-compliant payment processor. MsgHealth only ever receives a tokenized reference, never the raw card number.
Can another MsgHealth customer see my data?
No — every API request is authenticated, and every database query for your business data is scoped to your account before it runs. Sensitive tables also carry Row-Level Security (RLS) policies at the database level as an additional backstop.
Do you support healthcare or medical/dental businesses?
Yes, wellness-adjacent businesses (dental, medical, chiropractic, and similar) use MsgHealth — but MsgHealth is not HIPAA-certified out of the box, and we don't sign Business Associate Agreements (BAAs) today. If you handle protected health information (PHI) and need HIPAA-scoped handling, contact us about healthcare privacy and compliance requirements before storing PHI in client notes, messages, or call recordings.
Is my data encrypted?
Yes — all traffic to MsgHealth is encrypted in transit over TLS, and data at rest is encrypted at the database level. Especially sensitive fields, like worker SSNs/TINs for tax filing, get an additional layer of AES-256-GCM encryption on top of that.
Do you offer two-factor authentication (2FA)?
Not yet for every sign-in — account access currently uses email/password or phone OTP verification. Full account-level 2FA is on our roadmap.
How do you verify that a webhook (like a payment event) is really from that provider?
Every webhook is checked against that provider's cryptographic signature before MsgHealth trusts it. Requests without a valid signature are rejected.
Can I see a log of who accessed or changed my account?
Yes, on Enterprise plans — Audit Logs record sign-ins, settings changes, data exports, and team/role changes.
Where can I read your full privacy policy?
This article is a plain-language overview of our security practices. For the full legal privacy policy, including data retention and your rights, see our Privacy Policy page.
Still having trouble?
Reach out with an in-depth description of your issue and our team will get back to you within a few hours on business days.
- Response time
- Within a few hours on business days
- Help us help you faster
- Tell us what you were trying to do, what happened instead, and the steps to reproduce it. A screenshot helps.