Security

How Pingzy protects your data

These are the measures in place today. Pingzy has not been through a third-party security audit and holds no security certification.

• Encryption in transit: the website and API are served over HTTPS.
• Encrypted tokens: Gmail and Calendly access tokens are encrypted before they are stored and are never sent back to the browser.
• Passwords: passwords are stored as one-way hashes, never in plain text. You can also sign in with Google instead.
• Limited Gmail access: Pingzy asks only for the Gmail permissions it needs to send your approved emails and read replies to them. You can revoke access from Settings or from your Google account at any time.
• Verified webhooks: incoming webhooks from payment and scheduling providers are checked with signatures before they are processed.
• Rate limiting: sign-in and other sensitive endpoints are rate-limited to slow down abuse.
• Workspace isolation: each account's leads, campaigns and emails are scoped to its own workspace.

Infrastructure

The service runs on third-party hosting providers listed in our Privacy Policy, which are responsible for the physical security of their data centres.

Reporting a vulnerability

If you find a security issue, please email admin@pingzy.live with details and steps to reproduce. Please give us reasonable time to fix it before disclosing it publicly.