Security and data protection
How we protect your customers’ conversations
Aviral WhatsApp Platform holds your contacts, your chats and your WhatsApp credentials. This page says what protects them today, in plain words, and links to the legal documents behind it.
At a glance
What protects your data
Six things you can check in the product or in the documents. Each one is explained below.
Workspaces are isolated
Postgres row-level security keeps each workspace’s rows apart, and application code checks the workspace a second time.
Secrets are encrypted
Everything travels over HTTPS. WhatsApp tokens, PINs, payment and connector credentials are encrypted at rest, with a key per workspace.
Two-step verification
Authenticator-app codes and recovery codes for every user. Owners can require them for the whole workspace.
Roles you can shape
Six built-in roles, custom roles with a permission matrix, and access that can be limited per WhatsApp number.
An audit log
Admin actions are recorded with who, what and when, and can be exported as a CSV file.
Your data, your control
Set how long messages are kept, export your data, disconnect a number, or close the workspace.
Workspace isolation
One workspace can’t read another’s data
Every table that holds workspace data has a Postgres row-level security policy. Each request runs inside a database transaction tied to one workspace, so a query only sees that workspace’s rows, even if the application code asked for more. Queries also pass through workspace-scoped code, so isolation has two independent layers.
- Real-time connections, such as the live inbox, are authenticated when they open and are cut off when a session is revoked.
- A partner can reach only its own customers’ workspaces, enforced the same way in the database.
Encryption
Secrets are sealed with a key of their own
WhatsApp access tokens, two-step PINs, payment-gateway and connector credentials, webhook and API secrets, and authenticator secrets are never stored in readable form. Each workspace gets its own random 256-bit data key, which a master key kept outside the database encrypts. Each secret is sealed with AES-256-GCM and tied to its workspace and purpose, so a copy pasted into another workspace will not decrypt.
- Traffic between you, us and Meta runs over HTTPS.
- Secrets are masked after you create them: API keys and signing secrets are shown in full only once.
Audit log
Every important change leaves a record
Admin actions in your workspace are recorded with who did them and when, in a log that the application can add to but not rewrite. Filter it in Settings, or export it as a CSV file for your own review. Support sessions appear in it too.
- Role changes, invitations, setting changes and data exports are recorded.
- Each entry is written in the same transaction as the change it records.
The details
Sign-in, access and integrations
How people and systems get in, and what we do to keep that safe.
- Two-step verification
- Every user can protect their account with an authenticator app, and gets recovery codes in case they lose their phone. A workspace owner can require it for everyone: members without it are asked to set it up the next time they sign in, and an owner can reset a teammate who has lost their phone.
- Passwords and sessions
- Passwords are stored as Argon2id hashes. Sign-in attempts are rate-limited per IP address and per email address, and second-factor attempts are capped. Access tokens last 15 minutes, and the refresh token lives in an HttpOnly, Secure cookie that page scripts cannot read. Settings, then Security, shows where you are signed in and lets you end any session. Signing out, disabling a user or resetting two-step verification cuts off their sessions straight away.
- Roles and permissions
- Owner, admin, manager, agent, marketer and developer roles are built in. You can create custom roles from a permission matrix and limit access per WhatsApp number. Agents see only the chats they should, according to your workspace’s visibility setting.
- API keys and webhooks
- API keys carry scopes, can be limited to a list of IP addresses, and are shown in full only once, when you create them. Requests are rate-limited per key. Webhooks from Meta are verified against Meta’s HMAC signature before we accept them, and the webhooks we send to your systems are signed so you can verify them too.
- Support access
- In the product, our staff can open your workspace only through a support session. Each session needs a stated reason, lasts 15 minutes, is read-only unless the person has been given write access, and appears in your audit log. If you buy through a partner, the partner’s support staff can open sessions in the same way, logged the same way.
- Logs
- Application logs carry request and workspace ids, not message text, and redact secrets such as tokens, passwords and cookies at any depth.
Your data
You decide what is kept, and for how long
We process your customers’ data for you, on your instructions. We do not sell it.
- Choose how long messages and media, and call recordings and transcripts, are kept. A nightly job removes what is past your window.
- Export your workspace data whenever you like.
- Disconnect a WhatsApp number and we delete our access token for it.
- Close the workspace as its owner. You have 30 days to export or restore it, and after that the data is erased.
- Answer requests from the people you message: the product records consent and opt-outs, and lets you export and delete a contact.
The documents behind this page
- Privacy policyWhat we collect, why, and the rights you and the people you message have.
- Data processing agreementOur commitments as your data processor: instructions, security, breaches, deletion and audits.
- Sub-processorsThe companies that process data for us, what they do and where.
- Data deletion instructionsHow to have data deleted, for businesses and for people messaged by a business.
- Terms of serviceThe customer agreement, including how WhatsApp and Meta charges work.
Responsible disclosure
Found a security problem? Tell us
Email security@aviraltechlab.com with what you found, where you found it, and the steps to reproduce it. We will reply to confirm we have received it.
Ground rules
- Test only with accounts you own or have permission to use.
- Do not access, change or keep other people’s data. If you reach it, stop and tell us.
- Do not run denial-of-service tests or send spam through the product.
- Give us reasonable time to fix the problem before you share details publicly.
Frequently asked questions
Where is my data stored?
The platform is hosted on dedicated servers. The sub-processors page lists each company that processes your data for us, and where. If your auditors need more detail, ask us and we will answer in writing.
Do you have SOC 2 or ISO 27001 certification?
Not at the moment. We describe our controls on this page and in the data processing agreement, and we answer security questionnaires. Tell us what your review needs and we will say what we can provide.
Who can see my customers’ chats?
People in your workspace, within the roles you give them. In the product, our staff can open a workspace only through a logged support session with a stated reason. If you buy through a partner, the partner’s support staff can do the same, and it is logged the same way.
Does AI read my customers’ messages?
Only if you create and switch on an AI agent or use an AI feature. Then the text needed for the task is sent to our AI provider, which is listed on the sub-processors page. Card numbers, OTP and PIN codes and Aadhaar numbers are masked before text reaches the model.
How do I delete my data?
Delete contacts and conversations in the product, set a retention period for messages and recordings, disconnect a number, or close the workspace. For anything else, follow the data deletion instructions or write to us.
How does this relate to the DPDP Act?
Your business is the data fiduciary for the personal data of the people you message, and we act as your processor. The data processing agreement sets out our commitments, and the product has consent and opt-out records, export, deletion and retention controls to help you answer requests. Whether your own use complies still depends on how you collect consent and use the data, so have counsel review that.
Questions from your security team?
Send us your security questions or your vendor questionnaire and we will answer them in writing.