PerchpushYour users, your keys,your rules.
Perchpush sends through accounts you own, encrypts every credential you connect, and keeps your data on servers in Germany. Here is exactly how.
Runs on accounts you already own.
Pushes go through your own Firebase project and Apple key, email through your SMTP server and texts through your SMS gateway. Perchpush is the conductor, not the owner.
- No lock-in. Push tokens belong to your Firebase project. If you leave, they keep working with whatever you use next.
- Your sender reputation. Mail and SMS go out under your own domain and gateway account.
- Export any time. People, subscriptions, campaigns and recent delivery logs download as CSV.
Each one is sealed with AES-256-GCM before it touches the database.
Encrypted in transit and at rest.
TLS everywhere
All traffic to the dashboard, the API and the SDK endpoints is encrypted with TLS.
Sealed credentials
Firebase, APNs, SMTP, SMS, AI and webhook secrets are encrypted with AES-256-GCM under a versioned keyring.
Rotation without downtime
The keyring rotates with one command while sending carries on.
Hashed server keys
Server keys are stored only as a SHA-256 hash. You see a key once, and can rotate it instantly.
Limited client keys
The public key in your app can only register devices and report their own events. Server keys are refused by the SDKs.
Backups
Nightly database backups are kept for 14 days on the server, plus encrypted off-site copies for 30 days.
Six roles and an audit log.
Give each teammate only what they need. Every change to a campaign, key or teammate, and every data export, is recorded in the audit log.
- Named API keys per service, limited to the send, read or users scopes and an optional IP allowlist.
- Exports of personal data are limited to the roles that need them.
| Owner | Everything, including billing and deleting the app |
|---|---|
| Admin | Everything except billing and deleting the app |
| Developer | Keys, credentials, channels, webhooks, audience data |
| Marketer | Campaigns, journeys, in-app, links, segments |
| Analyst | Read-only analytics and exports |
| Viewer | Read-only |
Protection you don’t have to switch on.
Signed identity
Your server signs each user id with HMAC-SHA256. With “Require signed identify()” on, unsigned calls are rejected, so nobody can pose as one of your users.
Signed webhooks
Every webhook carries a Perchpush-Signature header with a timestamp and an HMAC of the body, so your server can reject anything forged or replayed.
Safe outbound calls
Webhooks, SMS gateways and mail servers can only be public internet addresses on safe ports, with no redirects followed.
Tenant isolation
Every query is scoped to an app the caller belongs to, and automated isolation tests run against each release before it goes live.
Rate limits and headers
Rate limits per key and per IP address, security headers on every page, and dependency updates for known vulnerabilities.
Less data, by design
Tracking-link clicks store a daily-salted hash of the IP address, not the address. Attributes you store are never returned to the client.
Hosted in the EU, kept only as long as needed.
- Germany (EU). Servers, database and backups are hosted by Hetzner.
- Retention you set. Delivery logs, events and inbox messages are deleted after each app’s retention window: 90 days by default, adjustable from 7 to 730.
- Erasure on request. Erase one person, or delete an app and all of its data at once.
- GDPR-ready DPA. Article 28 terms, Standard Contractual Clauses for transfers, and breach notice within 72 hours.
Full details in the privacy policy and the Data Processing Agreement.
| Hetzner Online GmbHServers, database and backups | Germany (EU) |
|---|---|
| Cloudflare, Inc.DNS and the optional AI features | Global network; USA |
| Google LLCSign in with Google | USA |
| StripeCard payments | USA / Ireland (EU) |
| PurelymailService emails such as sign-in links and receipts | USA |
Found a security issue?
Email us the details and the steps to reproduce it. Please give us a reasonable time to fix it before you share it publicly.
Security questions.
Where is my data stored?
Perchpush servers, database and backups are hosted by Hetzner in Germany (EU). The few providers that process data for us are listed with their purpose and location on the sub-processors page.
Do you offer a Data Processing Agreement?
Yes. The DPA meets Article 28 of the EU and UK GDPR and takes effect when you accept the Terms, with no signature needed. Email us if you want a countersigned copy.
Can I delete a user’s data?
Yes. “Erase” on a person’s page, or DELETE /users/:id from your server, removes the person, their devices, events, delivery logs and inbox. Deleting an app deletes all of its data at once.
How do I report a vulnerability?
Email security@neptechpal.com.np with the details. Please give us a reasonable time to fix it before sharing it publicly.
Messaging you can
stand behind.
Start free, connect your own Firebase key, and keep full control of your users and tokens.
