SECURITY & DATA

How we handle your data

The short version of what a security review asks about. If yours asks something not answered here, talk to us — we answer these in writing.

You own the connection

WhatsApp, Messenger and Instagram are authorised under your own Meta business, through Meta's Embedded Signup. The WhatsApp Business Account stays your asset. Leave, and the number leaves with you — there is no migration and no downtime for your customers.

Secrets in a vault

Channel tokens live in an encrypted vault and the database stores only a reference to them — never a plain column, and never anything the browser can read.

Workspace isolation

Every workspace is isolated at the database level: each query is scoped to the workspace by row-level security, not by application code remembering to filter. Roles and permissions sit on top of that, and sign-in is a one-time code by SMS, WhatsApp or e-mail.

Consent and deletion

Consent is tracked per contact, deletion requests are honoured, and every contact carries an activity log of what was sent and when.

Your conversations are not training data

Customer conversations are never used to train AI models — yours or anyone else's.