Security and Compliance
MorisBox is designed with security-first controls: partner isolation, hashed API keys, E2EE for in-app chats, and delivery-attempt logs.
This page describes what is available today for enterprise integrations. It is not a claim of SOC 2, ISO 27001, or HIPAA certification.
For the complete internal plan, see docs/COMPLIANCE.md in the repository.
Available now
| Control | Description |
|---|---|
| TLS | HTTPS on public sandbox hosts |
| API keys | Hashed at rest, scoped, with an optional IP allowlist (sk_… for partners and sk_dev_… for developers) |
| Partner / developer isolation | Each account sees only its own data |
| E2EE | In-app conversations / sealed hub - details |
| Delivery trace | Per-channel attempts on each message |
| Proof of Delivery API | GET /messages/{id}/audit (and Partner Hub message-detail UI) |
| DLP (ingress) | Optional scanning of non-E2E body text (dlp_mode) |
| DSAR export / deletion | End user GET /me/export, POST /me/delete (and Client Application Profile UI) |
| Retention | Partner / developer retention settings redact old plaintext bodies |
| Developer templates only | Developers can send only approved templates |
Proof of Delivery
GET /api/v1/messages/{message_id}/audit
Authorization: Bearer <partner_api_key>
Returns:
- Message metadata (body is null when encrypted)
- All delivery attempts (channel, state, provider reference, and timestamps)
- Related audit events
Use this as client evidence that MorisBox accepted and attempted delivery, not as a guarantee that the user read the message.
DLP (Data Loss Prevention)
Partner field dlp_mode:
| Mode | Behavior |
|---|---|
off | No scanning |
warn (default) | Scan plaintext; include warnings in the send response |
enforce | Block high-severity matches with 422 dlp_blocked |
E2EE ciphertext is never scanned. For regulated content, prefer encryption: "e2e" / the secure path.
GDPR (end user)
| Endpoint | Purpose |
|---|---|
GET /me/export | Portable account-data export |
POST /me/delete with { "confirm": true } | Anonymize the account (irreversible) |
E2EE plaintext is not stored on the server and cannot be exported by MorisBox.
Partner compliance settings
Exposed on the partner record / settings/me:
dlp_moderetention_days_messageshipaa_mode(policy flag - a signed BAA is required before processing PHI)
Roadmap
- PoD UI in Partner Hub
- Client-side DLP warnings
- Signed audit-export packages
- Formal SOC 2 Type II / ISO 27001 when organizational evidence is ready