Security at Blarumo
Practical controls for connected business communication
Blarumo is an independent developer platform built on official Meta APIs. This page describes current product controls without claiming third-party certification.
Authentication
Workspace access uses Firebase authentication. Server APIs verify Firebase ID tokens before resolving a user to an organization.
Tenant isolation
Customer records and operational API queries are scoped to the authenticated organization.
Connected credentials
Meta access tokens stored by Blarumo are encrypted before database storage. Never send credentials through contact or support forms.
Webhook verification
Supported provider webhooks are verified before processing, and duplicate external events are handled defensively.
Transport security
Blarumo is served over HTTPS and production database connections require TLS certificate verification by default.
Responsible operations
Customers control the Meta assets they connect and remain responsible for consent, message content, audiences, and policy compliance.
Report a security issue
Send a concise report to support@blarumo.com. Do not include passwords, private keys, access tokens, or customer message content in the first email.