On WhatsApp, a verified business profile and approved Message Templates.
Security & privacy
Security, privacy, and consent management for regulated communications
When messaging carries a transaction alert, a one-time password, or a policy notice, the questions a procurement team asks are always the same: who can access what, how is consent recorded, who is the verified sender, and which regulator has you on file. This page answers them in one place.
Security practices
Security practices aligned with SOC 2, GDPR, and OWASP, with authentication safeguards and access controls built into the platform rather than bolted on.
- SOC 2Aligned practice
- GDPRAligned practice
- OWASPAligned practice
Consent, by design and by default
Opt-in and opt-out state lives on the Contact record and is checked before a message is delivered — not reconciled afterwards. An opt-out registered on one channel applies across all of them.
Consent state, channel, and timestamp are retained per contact, which is what an audit or a customer complaint actually requires. Reporting is available in the Admin Console and over API.
Consent requirements differ by market, and the difference shows up in what you may send, to whom, and after which opt-in. Messangi applies the rules of the market you’re sending into rather than a single global default.
Jane M.Contact record
Consent state
SMS
Opted in
WhatsApp
Opted in
RCS
Opted in
Email
Opted in
Next message: cleared before delivery
ChannelStateTimestamp
SMSOpted in—
WhatsAppOpted in—
RCSOpted in—
EmailOpted in—
Admin ConsoleAPI
Message to Jane M.
Sending into Colombia
Rules of Colombia applied
Verified sender identity
In a region where smishing is routine, a sender your customers can identify is a security control, not a branding choice.
RCS
On RCS, a verified branded sender with your name and logo in the native inbox.
SMS
On SMS, registered sender IDs and short codes requested through each market’s regulator or registration process, with the registration work handled as part of onboarding.
Access control inside the platform
Compliance by market
Consent and sender registration requirements differ from market to market, and so does what a regulator expects to see. Messangi is licensed or registered with the regulator in the markets where it operates directly — CONATEL in Venezuela, the CRC in Colombia, and The Campaign Registry as a registered Campaign Service Provider in the US — and requests short codes through each country’s regulator in partner-served markets. Registration work with mobile operators happens during onboarding, and your team hears which requirements affect your use case before launch rather than after the first send.
Operates directlyMarket
CONATELLicensed or registered with the regulator
VenezuelaCRCLicensed or registered with the regulator
ColombiaThe Campaign RegistryRegistered Campaign Service Provider
United StatesPartner-served marketsShort codes requested through each country’s regulator
- OnboardingRegistration work with mobile operators
- Before launchRequirements that affect your use case
- First sendNo surprises after it goes out
Compliance, country by country
Licensing, sender registration, and operating model for each market Messangi serves.
Questions from your security review?
Send us the questionnaire. We’ll answer it with the same team that will run your onboarding.