Legal & data

Security

Version 1.0 · Last updated: 27 October 2026 · Effective immediately

On this page & related policies

This page explains how we protect the data brands trust us with. It is a plain description of our practices. Margifi does not currently claim any third-party security certification.

Hosting and data residency

  • Our main database runs on Supabase in the India (Mumbai) region.
  • Other providers, such as our hosting, email and analytics providers, are listed with their locations on our Sub-processors page.
  • WhatsApp data passes through Meta's servers, which may be outside India, under Meta's terms.

Encryption

  • In transit: all traffic to margifi.com, the Margifi app and our APIs uses HTTPS (TLS).
  • At rest: stored data, including backups, is encrypted by our hosting providers.
  • Phone numbers: customer phone numbers used for delivery follow-up are encrypted at field level, and all stored data is encrypted at rest by our providers. WhatsApp contact numbers are kept so Engage can send the brand's messages, with access limited to the brand's own account. Where we need to match a number, for example in the Margifi ID network, we use a keyed hash, so no plaintext phone number is shared between brands.

Tenant isolation

Every brand's data is kept separate. Our database enforces this with row-level security, so a user can only read the data of the brands they are allowed to access. In the Margifi ID network, other brands see only a risk tier for a phone number, never raw data and never which brand it came from.

Access control

  • Two-factor authentication with a time-based one-time code is required for app.margifi.com dashboard accounts.
  • Audit logs: when a user reveals a customer's personal data, such as a full phone number, the action is logged.
  • Least privilege: our team and our services get only the access they need for their job, and access is removed when no longer needed.

If something goes wrong

  • If a personal data breach affects your brand, we send an initial notice within 48 hours of becoming aware of it, and full details within 72 hours.
  • We also notify the Data Protection Board of India as the DPDP Rules require.
  • If a breach on your side affects Margifi systems or your Margifi credentials, tell us within 24 hours at admin@margifi.com.

Responsible disclosure

If you find a security issue in Margifi, email admin@margifi.com with the details and steps to reproduce it. Please give us reasonable time to fix it before telling anyone else, and do not access, change or delete data that is not yours while testing.

Version history

  • v1.0, 27 October 2026: First published.