Your customer conversations are your most sensitive asset. Here's how we protect them.

Tokens encrypted at rest

WhatsApp, Meta, email and PMS tokens are stored encrypted with AES-256-GCM, using a key that never lives in the database. They're decrypted only at send time, in memory.

Full tenant isolation

Every query on customer data is filtered by the workspace ID taken from the server-side session — never from the browser. There's no way to ask for another business's data.

Access and sessions

Passwords are stored with salted scrypt, sessions are opaque tokens in an HttpOnly cookie, and every sign-in attempt is rate-limited.

• Roles: owner, admin, agent, viewer
• Team invites via single-use links

Export and delete

Your data is yours. Export conversations, contacts, tasks and events anytime, and request full account deletion — including tokens and backups on the deletion schedule.

WhatsApp without the ban risk

Linked numbers behave like a person, not a bot. The rules are built into the system, not left to user caution:

• One desktop device identity per number — never two at once
• No auto-replies and no bulk sending
• On personal numbers: at most 20 messages an hour, 30+ seconds apart, only to chats you've already written in
• A send with an uncertain outcome is never retried automatically
• Instant alert when a number disconnects, and a note when it's back

AI with boundaries

Agents get only the tools they're allowed. Customer text is treated as data — never as instructions — so a malicious message can't make an agent act. We don't train models on your data.

Infrastructure

Managed Postgres with daily backups, TLS-only traffic, and secrets in the server environment — never in code.

Responsible disclosure

Found a security issue? Write to us through the contact page with the subject "security". We'll reply within 48 hours and keep you posted until it's fixed.