Privacy: what Mursilat stores and doesn’t
Inbox messages stored encrypted per account for the customer’s retention period; what the API keeps (metadata, for how long) and what it never returns.
Inbox messages and media are stored encrypted with a key unique to each account and deleted automatically after the retention period the customer chooses (7–365 days, default 90; forever on Business; or off = nothing kept). The server holds the keys so it can deliver messages, search them and run automations — this is encryption on our servers, not end-to-end encryption, and we don’t say otherwise. Mursilat admins and support have no screen or API to read message content.
Never returned by the public API
- Inbound messages: no public API endpoint returns them or any conversation history. They reach you only through your webhook, live.
- Files you upload through the API are kept in memory only, never written to disk.
- OTP codes (only a keyed hash), API keys (only a keyed hash), webhook payloads after the retry window.
What is kept, and for how long
| Data | Kept |
|---|---|
| Inbox messages, media and search index (encrypted per account) | KeptThe account’s retention period (default 90 days); none when retention is off |
| Webhook payload (for retries) | KeptIn memory for the retry window (≈ 75 minutes at most) |
| API message status ledger (masked recipient, status timeline, error code) | Kept30 days |
| Webhook delivery log (type, status, HTTP code, timing) | Kept7 days |
| Idempotency answers (ids and statuses only) | Kept24 hours |
| OTP rows (hash, masked recipient, status) | Kept7 days |
| Campaign text, media link, buttons, recipients | KeptDeleted within 24 hours after the campaign ends; totals stay |
| Scheduled messages (only if enabled for you) | KeptEncrypted until sent or cancelled (≤ 30 days) |
| Conversation metadata, labels, notes, quick replies, auto-reply rules, contacts | KeptKept — they are your working data |
Support access
Mursilat staff can open your account only after you grant access (up to 30 minutes, from your settings), and even then never your inbox or message content. Every grant and support session is audited.
The live policy is published at GET /api/v1/public/privacy and summarised on the home page.