Hosted in Vietnam
Application and database servers are located in Vietnam, and all traffic is served over HTTPS.
Security
Security built into every layer
Your customers, orders and ad accounts are the core of your business. Here is how we keep them safe.
Isolation per business
Each business’s data is separated at the database level with row-level security, so one account can never read another’s records.
Encrypted secrets
Access tokens for fanpages, ad accounts, carriers and partners are encrypted at rest and never returned to the browser.
Least-privilege access
Granular roles decide what each person can do, teams decide which data they can see, and customer phone numbers are masked without permission.
Immutable audit log
Important actions are recorded in an audit log that cannot be edited or deleted, so you always know who changed what and when.
Instant session revocation
When a permission is removed, affected sessions are signed out right away instead of waiting for them to expire.
Day-to-day practices
- Secrets are masked in error messages and logs
- Partner webhooks are signed and verified with a per-business secret
- Exports respect permissions and every export is logged
- Publicly uploaded landing page content runs in a sandbox, separate from the app
- Repeated failed API key attempts are rate-limited
- Changes are tested automatically before each release
Shared responsibility
We secure the platform, infrastructure and data isolation. You manage who has access to your account: assign roles carefully, remove staff who leave, and keep login details private.
Report a security issue
If you believe you have found a security vulnerability, please email support@cmcmedia.com.vn with details. We will acknowledge your report and keep you informed while we investigate.