Security Practices
Data Protection
We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. Every tenant's data is isolated by row-level security (RLS) at the database layer, and access tokens are encrypted at rest with AES-256-GCM.
Access Controls
Access to customer data is restricted to authorized personnel who need it to perform their job functions. Application secrets and credentials are never exposed to the browser. We follow the principle of least privilege for all internal systems.
Encryption
Data is encrypted in transit using industry-standard TLS 1.2+. Meta WhatsApp access tokens are encrypted at rest (AES-256-GCM) and proactively refreshed before expiry. Database connections are encrypted end-to-end.
Application Security
Responses carry an enforced Content-Security-Policy, HSTS, and anti-framing headers. Inbound WhatsApp webhooks are verified with Meta's HMAC-SHA256 signature and rejected if invalid (fail-closed). We conduct regular code reviews and static analysis.
Availability
We monitor platform availability with automated health checks and alerting. Incident response follows a documented runbook with escalation procedures. Uptime metrics are available on our status page.
Vulnerability Disclosure
We operate a vulnerability disclosure program. If you discover a security issue, please report it to [email protected]. We acknowledge all reports within 48 hours and provide a resolution timeline within 5 business days.
Penetration Testing
We conduct third-party penetration testing on a regular basis. The most recent assessment was completed in August 2026. Findings are remediated according to severity, with critical issues addressed within 24 hours.
SOC 2 Roadmap
We are working toward SOC 2 Type II certification. Our target completion is Q2 2027. Current controls include: row-level tenant isolation, AES-256-GCM encryption at rest, TLS 1.2+ in transit, HMAC-SHA256 webhook verification, role-based access controls, audit logging, and documented incident response procedures.
AI Data Handling
Our AI-Assisted Support feature uses Groq Cloud to generate draft replies. Customer message content is sent to Groq only when a user explicitly requests an AI suggestion. Content is not used to train models and is not retained after the response is generated (Zero Data Retention). Customers can disable AI features per inbox.