Security and compliance
Data residency, encryption, access control and data rights tooling for teams that process personal data.
Data residency
- Pushizo can run in the EU (Frankfurt) and TR (Istanbul) data regions with a cell architecture.
- An organization's data is processed in the cell of its assigned region; requests arriving at another cell are rejected.
- Organizations can be moved between regions with a controlled migration tool.
Encryption
- APNs, FCM, VAPID and SMTP credentials, webhook secrets and integration secrets are stored with AES-256-GCM envelope encryption.
- Data encryption keys are wrapped with a master key and can be rotated.
- Tracking links are HMAC-signed; the suppression list stores addresses as hashes only.
Access control
- TOTP-based two-factor authentication with recovery codes; organization-wide MFA enforcement.
- SSO with SAML and OIDC, domain verification and SSO enforcement; user and group provisioning with SCIM 2.0.
- Owner, admin, developer, marketer, analyst, billing, viewer and composer roles.
- IP allowlists at the organization and API key level.
KVKK and GDPR data rights
- API endpoints that export a user's profile, subscription and event data.
- When a user is deleted, subscriptions and aliases are removed and event and delivery records are anonymized.
- Data retention periods of 30, 90, 365, or 730 days depending on the plan; separate retention per event.
- Category-based communication preferences and a hosted preference center page.
Audit and monitoring
- Administrative actions are written to the audit log; records can be exported and forwarded to SIEM systems through daily NDJSON files and webhooks.
- Abuse controls: a first-day send cap, a phishing word list and disposable email domain blocking.
Related documentation
Send your first message with Pushizo
Create your account, add the SDK and send your first notification to a test device. New organizations get a 14-day trial with Starter plan limits.