This page describes security boundaries that are implemented and verifiable in the current codebase. We don't list aspirations or future intentions as present-tense facts.
Roles, seat scopes and granular permissions on every inbox action.
Each workspace is logically separated with encrypted storage.
Redundant message workers with live delivery monitoring.
Official platform access, approved templates, no grey routes.
Encryption at rest
AES-256
Transport security
TLS 1.2+
Audit retention
365 days
Technical boundaries verified in code, authenticated on each request, and tested in our CI/CD pipeline.
Each business workspace is a logically isolated unit. The service layer validates workspace membership on every authenticated request — using the requesting user's JWT and workspace ID — before any data operation proceeds. A valid session for workspace A cannot be used to query workspace B's data.
userAuthMiddleware.ts · workspace_membersEvery incoming WhatsApp webhook payload is verified using HMAC-SHA256 against a per-workspace secret before the payload is parsed or acted upon. Requests with missing, incorrect or replayed signatures are rejected at the earliest possible point. Each workspace has its own verify token.
webhookSignatureVerification · stage: signature_verifiedUser sessions are validated by verifying a Supabase-issued JWT against the configured project. The session validation middleware confirms the token is valid, extracts the user identity, and verifies that the user holds an active membership in the target workspace before the request continues.
authService.ts · userAuthMiddleware.tsTeam membership includes an explicit role — Owner, Admin, Member or Viewer. The service layer enforces role permissions for sensitive operations such as workspace configuration changes and team management. Roles are validated in the application service layer on each request.
teamService.ts · PERMISSIONS_MAPWhatsApp access tokens, Gemini API keys, database credentials and Supabase service-role keys are loaded exclusively from server-side environment configuration. The frontend application never receives, stores or transmits these values. Backend secrets are not embedded in the frontend bundle.
env.ts · server-side onlyEvery authenticated API request includes a workspace identifier that is independently validated against the user's membership record. The API does not trust the client's claimed workspace — it verifies the association server-side on each call.
AdminApiClient · X-Workspace-Id header · membership checkWe do not hold SOC 2, ISO 27001, HIPAA or GDPR certification. We are not an official Meta Business Partner. These may be relevant to your evaluation — we prefer to state this plainly rather than leave it ambiguous.
For security questions, vulnerability reports or architecture inquiries, contact engr.israrahmed01@gmail.com.
We're happy to discuss how the platform handles your data, answer architecture questions, or provide details relevant to your evaluation.