Security
Identity, access and audit controls
Each control is implemented in a named product and open to inspection. Written for the person completing a vendor security review.
- API access
- Scoped keys, IP allow-lists
- Webhooks
- Signed with HMAC
- Report an issue
- [email protected]
Scoped API keys
Mesa API keys carry only the scopes you give them and can be set to expire, so a key handed to one integration cannot do more than that integration needs.
- 01API keys scoped per permission, with expiry (Mesa)
- 02IP allow-listing by CIDR range (Mesa)
- 03Configurable rate limits (Mesa)
Separate workspaces
Each business on Mesa works in its own workspace, and team members see the conversations their role allows.
- 01Separate, isolated business workspaces (Mesa)
- 02Team roles and chat assignment (Mesa)
Audit and signed webhooks
Mesa logs API operations, and signs every webhook with HMAC so your system can check that an event really came from us.
Payment data never reaches us
Card payments run through Lipila’s hosted checkout, so card numbers are never received or stored by Zambrite. Mobile money settles directly with MTN, Airtel and Zamtel. All sites and products are served over HTTPS.
Reporting a vulnerability
Send it to [email protected] with enough detail to reproduce it. We confirm receipt and tell you what we find. Report in good faith and you will hear nothing from a lawyer.
Running a vendor review?
Send it over and we will answer every line as written, including the ones where the answer is no.