How we look after your money, customers and data
Marketing automation touches budgets, customer phone numbers and your brand's reputation. Here is exactly how DigiStorey protects each of them. Plain answers, and no certificates we don't actually have.
Nothing is spent on its own
Automation prepares; people decide.
Approval with the amount
Ad budgets, boosts and paid broadcasts become approvals showing the cost before anyone says yes.
Monthly caps
A hard limit per month. Above it, nothing is approved automatically, whatever the software suggests.
Spend alerts
Alerts at 80% and 100% of ad-account caps and paid-service limits, plus a daily cost summary.
Created paused
New campaigns are always created paused. Going live is a separate approval; pausing is instant.
Never twice
Each message or payment step is claimed before it runs, so a restart can never send it again.
Decision log
Who approved or rejected what, when, and for how much. It stays in the activity history.
Your customers are treated properly
Protecting your customers also protects your WhatsApp number, your e-mail domain and your ad accounts.
Opt-outs everywhere
"Stop" on WhatsApp or an unsubscribe ends messages on that channel for good.
Number health
Safe sending pace, warm-up for new numbers, automatic pause when Meta lowers quality.
E-mail checks
Every address is verified first; bounces join a do-not-send list; SPF, DKIM and DMARC are checked before outreach.
Ad safety
Personal-attribute targeting, health and money promises and housing discrimination are blocked before submission.
No spam, no link schemes
Outreach is one personal e-mail per website with an opt-out line. We never buy links or post on others' sites.
Company number only
Team members reply through the shared inbox; customers never see personal phone numbers.
Where your data lives
What we do today, stated precisely.
| Area | Question | How DigiStorey handles it |
|---|---|---|
| Isolation | Is our data mixed with others? | No. Each company runs its own instance with its own database and storage folder. |
| Hosting | Where does it run? | On Amazon Web Services, behind HTTPS with automatically renewed certificates. |
| Backups | What if something breaks? | A full backup every day, copied each night to separate encrypted cloud storage. |
| Access | Who can sign in? | Only people you add, each with a role. Sessions expire, sign-in attempts are throttled, every change is protected against forged requests. |
| Secrets | What about our API keys? | Stored hidden, never shown again in full, never sent to the browser. Facebook, Google and LinkedIn connect by sign-in, not pasted passwords. |
| Webhooks | Can someone fake a message? | Incoming events from Meta, Twilio and Google are checked against their signatures before anything happens. |
| Releases | Can an update break our setup? | Each release is tested on a copy of the data first; if the new version doesn't answer, the previous one is restored automatically. |
| Our staff | Can your team see our dashboard? | The platform team manages instances but cannot open a company's dashboard. |
Questions from IT teams
We're happy to fill in your vendor questionnaire and join a call with your security team.
Where is our data stored?
On Amazon Web Services, in a private database for your company, with daily backups copied to separate encrypted cloud storage.
Do you hold certifications such as ISO 27001 or SOC 2?
Not yet, and we won't claim them before we do. We are happy to answer your security questionnaire and walk your IT team through the setup.
Who can see our customer data?
Only the people you add to your workspace. Our platform team cannot open a company's dashboard.