Trust
Security you can explain to your own customers
What we do today, stated plainly. Where something is not done yet, we say so.
Account protection
Two-step login
Authenticator-app codes with single-use recovery codes. Workspaces can require it for every admin.
Strong passwords, lockout
10+ characters, common passwords refused, argon2 hashing. Repeated wrong attempts lock the account briefly.
Sessions you control
Change your password or tap Log out everywhere and every other device is signed out at once.
Roles
Owner, admin and agent. Agents can be limited to their own and unassigned chats. Billing, campaigns and settings stay with admins.
Scoped API keys
Read-only or read-write, optional expiry, revocable in one click. Keys can't create more keys.
Activity log
Sign-ins, role changes, key and billing events, exportable as CSV.
Data protection
Encrypted secrets
WhatsApp tokens, AI keys and 2FA secrets are encrypted at rest with rotatable keys and never sent back to the browser.
Tenant isolation
Every record belongs to one workspace. Automated tests try cross-workspace access on every route.
Safe uploads
Files are identified by their contents, not their name, and served with hardened headers.
Signed webhooks
Inbound Meta, payment and store webhooks are signature-checked. Outbound webhooks to you are HMAC-signed with a secret you can rotate.
Payments
Card and UPI details go to Razorpay, never to us. We verify every payment signature server-side before crediting anything.
Rate limits
Per-IP and per-account limits on login, signup, uploads and API calls.
Your customers' rights (DPDP)
Consent ledger
Every opt-in and opt-out is recorded with source and time. Export the proof as CSV.
Export and erase
Per-contact data export and erasure. Erased people are never re-added by import.
Retention
Set how many days messages are kept; older ones are deleted automatically.
Workspace export
Owners can download all of their data at any time.
We have not yet completed an independent security audit or certification. Report a vulnerability to the contact address on our Contact page; we respond within two business days.
Questions from your security team?
We're happy to answer them in writing.