Security
WhaOne isolates each customer organization and uses official Meta WhatsApp Business Platform APIs. The items below describe controls that exist in the current product. This page does not claim SOC 2, ISO 27001, GDPR certification, HIPAA, or PCI compliance.
Customer data is scoped to the signed-in organization's membership. Application checks compare the session organization with the URL organization, and PostgreSQL row-level security blocks cross-tenant reads even if an organization id is forged.
Workspace roles are owner, admin, manager, and agent. Permissions are a server-side matrix. The browser cannot grant itself a role. Platform operators use a separate permission layer and are not implied by organization ownership.
WhatsApp Cloud API access tokens are encrypted at rest with AES-256-GCM. They are not returned on APIs or written to application logs. Production deployments require a dedicated token encryption key.
Web sessions use opaque tokens stored only as SHA-256 hashes. The session cookie is HttpOnly and SameSite=Lax, and is marked Secure in production. Passwords are hashed with Argon2id. Session tokens are not stored in localStorage.
Sensitive workspace actions can be written to an organization audit log, including actor, action, resource type, and redacted metadata. Platform operator actions are kept out of tenant-visible audit views.
The API applies named request throttles, including stricter limits on authentication endpoints and a separate budget for Meta webhook ingestion.
WhaOne connects businesses to WhatsApp using Meta's official WhatsApp Business Platform. Webhook signatures are verified with HMAC-SHA256. There is no WhatsApp Web automation, QR session cloning, or unofficial client in the product.
Questions: see Contact and the Privacy Policy.
Get started
Ask about tenant isolation, roles, and official WhatsApp Business Platform connections.