Testing
Safe to experiment
- Sandbox keys start with sv_test_ and can only run simulations
- Simulations make no provider calls and use no wallet funds
- Simulation results are kept for seven days
Security
Built so every send is accounted for.
SavaraFlow handles your customers’ numbers, their consent and your money. Here is how each is protected, described as the product actually works today.
Access
Who can do what.
Keys, roles and invites are designed so access is narrow by default and easy to revoke.
Keys stored as hashes
API keys are shown once when created. Only a hash is stored, and you can revoke a key at any time.
Channel-scoped keys
Each live key grants a fixed set of enabled channels. Sandbox keys can only run simulations.
Rate limited
Each workspace can make 60 API requests per minute.
Workspace isolation
Workspace data is protected with row-level security in the database, so members only see their own workspace.
Owners and agents
Owners invite and remove teammates and assign work. Agents handle conversations and can assign them to themselves.
Verified invites
Invites expire after seven days and only work for the verified email they were sent to.
Your customers
Consent is enforced, not assumed.
Consent on every send
API sends require consent: true. Each contact records the channels they agreed to, and fallback only uses those.
Opt-outs respected
STOP and UNSUBSCRIBE replies, and suppression events from connected mail accounts, block that destination on that channel.
Resubscribing is deliberate
Removing a suppression needs separately verified consent and operator review.
Checked again at dispatch
Consent, address, channel connection, price and balance are checked when each message leaves the queue, not only when it is accepted.
Encrypted provider credentials
WhatsApp access tokens and workspace provider credentials are stored encrypted.
Smart assist stays supervised
Smart assist sees a limited view of the current conversation, never sends on its own, and is capped at 100 requests per workspace per day.
Webhooks
Events you can trust.
Delivery events are sent to your server with a signature you can verify. Test a signature right in the browser before you write any code.
Open the signature testerYour wallet
No surprises on the bill.
Reserve before send
Every live send reserves its quote first. Batches reserve the whole amount, so they never half-send.
Spending caps
Set a maximum cost per request, a cap per campaign and a rolling one-minute spend limit that pauses activity and alerts the owner.
Verified top-ups only
Only a verified payment adds credit. A currency or amount mismatch goes to payment review.
No automatic resends
If a provider’s answer is uncertain, the attempt is held for review rather than sent again.
Operations
Watched and reversible
- A workspace can be paused to stop direct requests and queued delivery
- Disabling a channel makes its queued sends ineligible at dispatch
- Operator actions are recorded with the acting operator and time
Have a security question or found an issue? See our privacy notice for how to reach us.
Try it without risk.
Sandbox keys never touch a provider or your wallet.