Security

Your customer conversations are sensitive. Here is how Whatsent is built to protect them.

Isolation between companies

Every company's data is separated at the database level, so one company cannot read another's contacts, conversations or settings, even if an application bug were to occur.

Protecting secrets

WhatsApp access tokens, app secrets, API keys and other credentials are stored encrypted and are never shown again after you save them. API keys are stored as hashes.

Access control

• Role-based permissions with custom roles; team members only see what their role allows
• Option to limit a team member to specific WhatsApp numbers
• Two-factor authentication and recovery codes for sign-in
• Rate limiting and lockouts on repeated failed sign-in attempts

Auditability

Important actions, such as sign-ins, consent changes, exports and platform administration, are recorded in an audit log.

Webhooks and API

Outgoing webhooks are signed so you can verify them, and incoming Meta webhooks are verified against the app secret. API keys are scoped and can be rotated or revoked.

Reporting a vulnerability

If you believe you have found a security issue, email support@whatsent.com with the details. We will acknowledge it and keep you informed.