Skip to main content
WWorldsContact
Sign in Talk to sales
Trust centre

Security communicated
without shortcuts.

See the safeguards already built into WorldsContact, the responsibilities customers retain, and the controls still on our enterprise roadmap.

Request a security review →
CURRENT POSTURE

Controls implemented today.

Production HTTPS enforcement Configured
Server-side credential storage Configured
Credit transaction ledger Active
SOC 2 / ISO 27001 Not certified

Practical controls in the application foundation.

This page describes the current codebase—not a future-state promise. Deployment controls must also be validated on the production VPS.

IDENTITY♢

Secure authentication

Password hashing, CSRF protection, secure production cookies and authenticated tool endpoints use established Django controls.

SECRETS◇

Server-side credentials

Verifier and payment keys are designed to remain in environment variables and never reach the browser.

BILLING◎

Atomic credit ledger

Balance updates use database transactions; usage, refunds and purchases retain a traceable record.

RESILIENCE⌁

Failure-safe charging

If an upstream verifier request fails, the corresponding credits are automatically returned.

PRIVACY@

Data minimisation

Tool usage records avoid storing raw request payloads by default and retain only operationally necessary results.

ASSURANCE↗

Transparent roadmap

SSO, granular roles, retention automation and external assurance are enterprise roadmap items—not current claims.

Shared responsibility

Responsible outreach requires more than software.

Customers choose their contacts, lawful basis, content, sending identity and retention rules. WorldsContact provides workflow controls; it does not provide legal advice.

  • 1
    Document the lawful basis and purpose for each audience.
  • 2
    Use accurate sender identity and a working opt-out path.
  • 3
    Maintain suppression lists and honour objections promptly.
  • 4
    Review regional rules before launching a campaign.
ASSURANCE STATUSSeptember 2026
Application security baselineImplemented
Enterprise access controlsRoadmap
Independent certificationNot certified

Need a detailed control review?

Send your security questionnaire and intended deployment profile.

Contact the security team →
Identity protection

Verified email, with optional two-factor authentication.

Every newly created account must verify its email address before workspace access. Users can optionally protect sign-in with a standard authenticator app and single-use recovery codes; administrators can audit status and perform a recorded recovery reset.