Platform Security Overview

Mersal handles sensitive things on your behalf — your customers' phone numbers and emails, the credentials for your sending gateways, and the API keys that can send messages on your account's behalf. This page is a plain overview of the account-level and platform-level protections in place.

Account access

• Two-factor authentication (2FA) — you can secure your login with a standard TOTP authenticator app, or with the dedicated Mersal Authenticator app, which supports both offline 6-digit codes and an online "approve sign-in" flow. See Two-Factor Authentication for setup.
• OTP-based verification — login and password-reset flows support one-time-passcode verification, so account recovery doesn't rely solely on a static password.
• reCAPTCHA — public-facing forms (like signup and login) are protected with reCAPTCHA v2, to cut down on automated abuse and bot signups.

Protecting against fake or low-quality signups

When a new account is created, Mersal runs email verification checks beyond simple format validation — including MX record checks, syntax validation, disposable-domain detection, typo detection, and role-address detection (addresses like admin@ or info@ rather than a real individual). These checks exist to keep the platform's sender reputation clean and to reduce fake accounts, which indirectly protects every genuine account's deliverability too.

API access

• Scoped, per-account API keys — your channel-sending API key and your AI Pool key (for the AI Gateway) are separate credentials, generated per account, and only work for that account's data and sending allowance. See API Key Management for how to find, rotate, and safely handle them.
• Webhook secrets — webhooks that deliver delivery/reply events to your own systems are signed with a secret you control, and that secret can be rotated if you suspect it's been exposed. See Webhooks for the signing details.

Your responsibility

Platform-level protections only go so far — the most common real-world security failures are things like an exposed API key committed to a public repository, or an account without 2FA enabled getting its password reused from a breached site elsewhere. Treat your API keys and account credentials the same way you'd treat any other production secret.

Next steps

• API Key Management — finding, rotating, and safely handling your keys.
• Two-Factor Authentication — setting up TOTP or the Mersal Authenticator app.