Security principles

Insimen is designed around least-privilege access, protection by design, and limiting impact when an issue occurs. No digital system is risk-free, so controls are reviewed and improved as the product evolves.

Product controls

Controls are applied in proportion to the feature and its risk.

• status-privacy controls and settings for who may start a conversation
• conversation and attachment access checks based on session and membership
• upload limits, file-type validation, and private attachment storage
• logging of moderation actions and significant activity without broadly exposing private content

Your role

Keep your account and devices secure.

• Use a unique password and never share it.
• Enable available account verification methods.
• Do not send passwords, one-time codes, tokens, or other secrets through regular messages.
• choose a status audience carefully before publishing
• respect other people's privacy, copyright, and safety
• not send spam, fraud, hate speech, harassment, or unlawful content

Sensitive access and changes

Sensitive changes are checked server-side. Relevant activity may be recorded to support security, abuse prevention, and incident investigation.

Incident reporting

If you suspect unauthorized access, change your password, sign out of unrecognized sessions, and contact us. Do not include passwords, one-time codes, or unnecessary private content in a report.

Important limit

User-generated content remains the sender's responsibility. Insimen is not an emergency channel and is not a substitute for professional help or competent authorities.

Shared security responsibilities

Insimen applies controls appropriate to context and risk, including authority checks, session protection, validation and restricted access to sensitive data. Controls are reviewed as services change; this description does not certify every integration or promise identical controls everywhere.

Use a unique password, device protection and available additional verification. Check domains, recipients and permission requests before sharing data. Support does not request passwords, PINs, one-time codes, private keys or recovery codes. Organisation owners should review members and remove obsolete access.

Reporting, evidence and recovery

Report suspected account takeover, unauthorised data access or transaction errors to cs@insimen.com with the service, incident time and a safe description. Do not exploit an issue, access others’ data, publish secrets or send unnecessary sensitive samples.

Insimen may verify ownership, restrict risky sessions or features and review relevant records. Recovery depends on findings and the incident; a report alone does not guarantee recovery of all data or funds. Actions remain subject to statutory duties and user rights.

Invitations, impersonation, and harmful links

Check the sender’s identity before accepting an invitation, opening an attachment, following a link, or recording a call. Do not trust a request for money or a one-time code solely because it comes from a familiar account. Report impersonation, threats, or improper conversation access through official channels; keep relevant references without disclosing account secrets.