Trust, data portability & deliverability

Your data is yours — provably

The push industry has burned people: "free forever" providers shut down with subscriber bases locked inside, and the biggest free tier historically monetized by sharing interaction data with advertisers. WingBlaze's answers are concrete, not promises:

• One-call full export. GET /v1/apps/:appId/export streams your entire audience as NDJSON — every subscriber with devices and tags inline, your suppression list, and a summary line with counts. Any size, any time, no support ticket. Per-subscriber export exists too (GET /v1/apps/:appId/subscribers/:id/export, includes recent events).
• Real deletion. Deleting a subscriber cascades through devices, tags, inbox items, and journey state. Deleting an app removes everything it owns.
• No ad monetization. Ever. Your subscribers are not the product; the subscription is. Nothing is shared, sold, or "anonymized and aggregated" to third parties.
• Standard formats in. Importers for OneSignal (CSV) and AWS Pinpoint (endpoint JSONL) — switching to us is easy, and the export above means switching away stays easy. We'd rather keep you with the product.

Where your data lives

Everything is hosted in asia-southeast1 (Singapore) — no cross-region replication. For Malaysian PDPA (2024 amendments) and Indonesian PDP (UU 27/2022) compliance work, in-region hosting means no cross-border transfer assessment for the messaging data path. Security controls — per-tenant credential encryption at rest, role-based access with an owner boundary, an append-only audit log, and tenant scoping enforced on every query — are mapped against the SOC 2 common criteria internally; ask us for the current mapping if you need it for a vendor review.

Email engagement tracking

Marketing email carries a signed open pixel and tracked links so that opens and clicks are recorded against the campaign (see Channels). The tokens are HMAC-signed and identify the send, not the person's browser; no third-party tracker is involved, and a click redirect only leads where the platform put that link in that email. Transactional mail is never tracked, an erased subscriber's mail records nothing, and switching tracking off under Settings → Send policies stops recording for mail already sent as well as future mail (which then carries plain links and no pixel).

Events retention

The event stream — deliveries, opens, clicks, custom events, the material of segments, timelines and insights — is kept for 90 days, then dropped. An app can choose less (7–90 days) under Settings → Send policies, or with PATCH /v1/apps/:id/settings {"eventsRetentionDays": 30}: its older rows are deleted over the next hourly sweeps, and segment and journey-condition windows past that retention are refused rather than answered from missing data — shortening below a window that is already saved is refused until that filter is fixed. Insights, campaign delivery and engagement figures, and the predictive bands are computed from the event stream, so they only ever see what is still retained (a campaign's sent count is a ledger figure and stays). GET /v1/apps/:id reports the days in effect. Subscriber erasure (DELETE /v1/apps/:id/subscribers/:sid) is immediate and does not wait for retention.

Live service health, with uptime checks on every public endpoint, is at status.wingblaze.net.

Team & roles

Every workspace has four cumulative roles — viewer (read only), member (operate messaging), admin (+ settings, credentials, API keys, integrations, and the team), and owner (+ billing, branding, client workspaces). Admins invite teammates by email at a chosen role under Team; the invite is a signed, single-use, 7-day link and the recipient must accept it while signed in with that same email. Membership is re-checked on every request, so revoking or downgrading someone takes effect immediately, and a workspace can never lose its last owner.

Sign-in supports email/password, Google, and SAML SSO — configure your identity provider (Okta, Azure AD, Google Workspace, OneLogin…) under Team → SSO, and members signing in with a matching work-email domain are routed to your IdP and provisioned automatically at the default role you set. WingBlaze requires the IdP to sign its assertion and validates it against your configured certificate and the SP audience.

Email deliverability

WingBlaze ships the compliance rails automatically: RFC 8058 one-click unsubscribe headers on every marketing email, automatic bounce and complaint suppression (checked before every send, transactional included), and a strict transactional/marketing separation — transactional mail never carries an unsubscribe offer and never queues behind campaigns.

What you configure on your side:

1. Verify your sending domain (not a shared one) in SES via the setup flow: SPF (include:amazonses.com), the three DKIM CNAMEs, and a DMARC policy — start with p=none; rua=mailto:you@domain, tighten to p=quarantine once reports look clean.
2. Warm up gradually. New domains should ramp over ~2–4 weeks; use segments to send to your most-engaged subscribers first (the _engagement auto-tag is built for exactly this).
3. Watch the suppression list (GET /v1/apps/:id/suppressions): rising complaint suppressions mean content or targeting problems — fix those before they become reputation problems.
4. Keep marketing off transactional traffic. The lanes are separate so receiver reputation systems see consistent behavior per stream.