Security
Security for message-sending infrastructure.
Dugble protects the surfaces that matter for A2P workflows: keys, sessions, webhooks, workspace access, and message logs.
X-Dugble-Signature:
t=1721642042,v1=5f3d8c9e2a1b...
How a request is verified
Five checks before anything runs.
Not every request hits every stage. A signed webhook doesn't need a CSRF check, a dashboard click doesn't need a signature but nothing skips scope and session checks.
Request arrives
Checked for a valid API key or a live browser session.
Workspace scope check
The key or session is matched to one workspace. Cross-workspace access is rejected outright.
CSRF check
State-changing dashboard requests require a valid, single-use token.
Signature check
Outbound webhooks are signed; sensitive admin actions are verified before they apply.
Processed & logged
The action runs, and it's recorded in the workspace's audit trail.
What's in place today
Grouped by what they actually protect.
Keys & sessions
Server-side API keys
Scoped to a workspace, meant to live on your server, never in client code.
Session checks
Every authenticated dashboard request is checked against a live, revocable session.
Authorization: Bearer sk_live_51ac9f2e... Cookie: dugble_session=•••;HttpOnly;Secure;SameSite=Lax
Workspace isolation
Workspace-scoped access
Keys, senders, logs, and members are isolated per workspace by default.
Audit log foundation
Sensitive workspace actions are recorded so you can reconstruct what changed and when.
X-Dugble-Workspace: wsp_4b71ea > 403 if the key or session isn't a member of wsp_4b71ea
Webhooks
Signed events
Every event is signed so your backend can verify it came from Dugble before acting on it.
X-Dugble-Event: message.delivered X-Dugble-Signature: t=1721642042,v1=5f3d8c9e...
Dashboard protection
CSRF tokens
State-changing dashboard actions require a valid, single-use token.
POST /dashboard/senders/verify X-CSRF-Token: 9f2a1b7e-4c3d-...
Data handling
What we actually keep.
Recognizable from the dashboard preview elsewhere on this site. The masking you've seen isn't cosmetic, it's the default.
Recipients are masked by default
The dashboard shows +233 55 •••• 12, not the full number. Full values are only ever visible where a workspace member explicitly needs them.
Metadata, not message content, is what's retained
Delivery tracking relies on status, timestamps, and provider responses, not storing the message body long-term.
Logs never cross workspace boundaries
A workspace's logs are only ever visible to members of that workspace, with no cross-tenant view, ever.
Dugble is early-stage and doesn't hold formal certifications like SOC 2 yet. What's on this page reflects what's actually built today, not a compliance checklist - and it's the foundation the rest of this is built toward.
Found something?
If you believe you've found a security issue in Dugble, we'd rather hear it from you first.