Loading…
Your customer conversations are sensitive. We treat them that way.
TLS 1.2+ in transit. WhatsApp access tokens, app secrets and webhook secrets are encrypted at rest with AES-256-GCM and never returned by any API.
Every database query is scoped to your workspace. Cross-tenant access is structurally impossible and covered by automated tests in CI.
Argon2 password hashing, optional TOTP two-factor authentication, rotating refresh tokens in httpOnly cookies, and session management with per-device revocation.
Five roles with granular permissions enforced server-side on every request. API keys carry explicit scopes and per-minute rate limits.
Sensitive actions – sign-ins, settings changes, exports, key rotations – are recorded in an immutable audit log.
Webhook signatures verified on ingest, idempotent processing, automatic retries with backoff and dead-letter queues so no message is silently lost.
Found a vulnerability? Report it responsibly to security@waclino.co – we respond within 24 hours.