What is stored,
and for how long.
Security pages usually list adjectives. This one lists mechanisms and retention windows, including the two things Nishchit does not have. Report anything you find to [email protected].
Six things that
actually protect you.
Each of these is a property of the running system, not a policy document about it.
Stored as a hash, shown once
A key is generated, displayed a single time, and only its SHA-256 hash is written down, alongside the prefix and last four characters so you can tell two keys apart in a list. Nishchit cannot show you a key again, because it does not have it. Revoking is immediate: the lookup cache is invalidated on revoke rather than aged out.
argon2id, not a fast hash
Dashboard passwords are hashed with argon2id — memory-hard by design, so a stolen database cannot be attacked at GPU speed. Password reset and email verification tokens are themselves stored as hashes and expire.
httpOnly cookie, CSRF double-submit
The dashboard session is an httpOnly, Secure, SameSite=Lax cookie. It is not readable from JavaScript, so a cross-site scripting bug on the page cannot exfiltrate it — which is exactly what a token in localStorage cannot promise. State-changing requests additionally carry a double-submit CSRF token.
HMAC-SHA256 with a timestamp
Every webhook carries a nishchit-signature header: an HMAC-SHA256 of the timestamp and the raw body, compared in constant time. The timestamp is part of the signed payload, so a captured delivery cannot be replayed at you later. Verify it before you trust the body.
How to verify a signature →TLS 1.2 and 1.3 only, HSTS on
The API and this site terminate TLS 1.2 and 1.3 with forward-secret cipher suites, and send Strict-Transport-Security with a one-year max-age including subdomains. Port 80 answers only to issue a permanent redirect to HTTPS; nothing is served over it.
Four independent ceilings
Requests are limited per IP, per API key, per organisation and per endpoint, each with its own window. Authentication endpoints are limited far harder than the rest. New projects also sit on a trust tier with a daily send ceiling that is independent of the credit balance, so a leaked key cannot spend an account overnight.
The published limits →Data has an
expiry date here.
The default is to lose data rather than keep it. These windows are enforced by a job that runs continuously, not by a promise to delete on request.
| WHAT | KEPT FOR | WHY |
|---|---|---|
| Message body | 30 days | Bodies carry passcodes and customer names — the highest-liability data in the system. They are redacted in place on a schedule, and the redaction is recorded so support can tell "never stored" from "aged out". |
| Message metadata | 13 months | Recipient, status, segments and cost. Long enough to reconcile a full year of invoices, then deleted. |
| Delivery events | 90 days | The per-message event trail behind the timeline in the dashboard. |
| Content decisions | 180 days | What the content guard allowed or blocked, so an appeal can be reviewed against the actual verdict. |
| Audit log | 24 months | Who did what in the dashboard: key creation, revocation, member changes. |
The website itself sets no cookies and runs no third-party tracker. Full detail in the privacy policy.
What Nishchit
does not have.
An infrastructure provider that only publishes its strengths has told you nothing you can act on.
No two-factor authentication yet
The dashboard authenticates with a password and there is no second factor available yet. It is on the roadmap and it is not shipped, so it is listed here rather than implied by silence.
No third-party audit or certification
Nishchit holds no SOC 2, ISO 27001 or PCI attestation. Claiming a framework nobody has audited against is worse than having none, so this page states the controls themselves and lets you judge them.
Asked before
the contract, ideally.
How do I report a vulnerability?
Can Nishchit staff read my message bodies?
What happens if an API key leaks?
Is the content guard reading my messages?
Where is the data stored?
Your product has something to say.
Give it a reliable way to say it.
Self-serve signup, live immediately. Content checked instead of paperwork.
One credit per segment at ৳0.50. No contract, no monthly minimum, no expiry.
An nk_test_ key never reaches a carrier or spends a credit.
One country, done properly — Bangla pricing, observable delivery.