Wapimate handles your customers' data and your WhatsApp and Shopify connections. This page explains how we protect them and what we do if something goes wrong.
Data protection
- Encryption in transit: every connection uses HTTPS with HSTS.
- Encryption at rest: WhatsApp and Shopify access tokens are encrypted with AES-256-GCM, and the database and backups are stored on encrypted disks.
- Hosting: Oracle Cloud Infrastructure in Mumbai, India.
- Workspace isolation: every request is scoped to your workspace, and access to another workspace's data is blocked and tested.
- Backups: the database is backed up daily, and backups are kept for 14 days.
- Separate environments: development and testing never use production data.
Access control
- Passwords are hashed with scrypt, sign-ins are rate-limited, and sessions are revoked when a password changes.
- Your team has owner, admin and agent roles, checked on the server for every action.
- Only the Wapimate owner can access production systems. Any support access to your workspace uses a one-time link and is recorded in the audit log.
- Sign-ins, connections, payments, team changes and all administrative actions are logged.
Integrations
- Every webhook from Meta, Shopify and Razorpay is signature-verified before it is processed.
- We request only the Shopify permissions Wapimate needs, and honour Shopify's privacy requests automatically (see our DPA).
- Payments are handled by Razorpay; we never see or store card details.
Incident response
If we detect or are told about a security incident, we:
- Contain it: revoke affected credentials and sessions and close the cause.
- Investigate: use audit and server logs to find what happened and which data and workspaces were affected.
- Notify: tell affected businesses without undue delay and within 72 hours, and notify Shopify, Meta and authorities where required.
- Recover: restore service, from backups if needed, and confirm the fix.
- Learn: record the incident and the changes made to prevent it happening again.
Reporting a vulnerability
If you find a security issue, please tell us through our contact page before disclosing it publicly. We'll confirm receipt within two business days and keep you updated.