Security
Company data stays company-scoped
WhatsApp conversations contain personal and commercial information. Access, isolation and safe automation are part of the product architecture, not add-ons.
At a glance
- Company isolation
- Granular permissions
- Two-factor authentication
- Safe AI boundaries
Controls
Security controls in the workspace
These are the practical controls the application is designed around. Final security documentation should be reviewed before enterprise procurement.
Company scoping
Company-owned records are accessed through company membership and scoped bindings.
Roles and permissions
Company-specific roles control who can view or manage each module.
Two-factor authentication
Fortify-compatible two-factor authentication and recovery codes are supported.
Webhook verification
WhatsApp webhook requests are verified before events are trusted.
Audit and activity
Important workspace actions and activity history can be reviewed.
Safe AI
AI capabilities are permission-filtered and drafts require human review.
Responsibilities
Security is shared
- Keep secrets such as WhatsApp access tokens and webhook secrets out of logs, screenshots and shared documents.
- Review who holds Owner and Admin roles, and remove access when a teammate leaves.
- Use two-factor authentication for privileged accounts.
- Confirm your Meta business verification, template content and consent records.
- Test AI behaviour and knowledge content before relying on it in production.
Reporting a vulnerability
If you believe you have found a security issue, contact us using the contact page with enough detail to reproduce it. Please do not access another company's data, disrupt the service or publish details before we have had a reasonable chance to respond. We do not currently advertise a paid bug bounty programme.
Procurement questions
For security questionnaires, data processing terms, hosting locations or AI provider configuration, contact the team. Final commitments should be documented in the commercial agreement rather than inferred from this page.
Can one company see another company's conversations?
Company-owned resources are scoped to the active company and access is checked through membership, roles and permissions. Cross-company references are rejected.
Is two-factor authentication supported?
Yes. The application supports two-factor authentication and recovery codes for accounts.
Are secrets logged?
The application is designed to avoid logging passwords, access tokens, webhook secrets, invitation tokens, session cookies and authorization headers. Review the final deployment configuration and log retention before production.
Does AI have unrestricted access?
No. AI capabilities are permission-filtered, outputs are validated server-side, and the workspace assistant proposes actions for review rather than executing arbitrary operations.
Next step
Ready to run WhatsApp properly?
Bring the inbox, campaigns, automations, leads and AI into one company-scoped workspace.