Security

As a WhatsApp Business Platform Tech Provider / Third Party Service Provider, we maintain administrative, physical, and technical safeguards designed to meet or exceed industry standards given the sensitivity of Business Solution Data, comply with applicable privacy and security laws, and prevent unauthorised processing (including access, destruction, loss, alteration, disclosure, distribution, or compromise), consistent with the WhatsApp Business Solution Terms.

• Documented access control and least-privilege administration for production systems
• Employee / contractor confidentiality obligations for personnel with data access
• Security ownership via our operations team reachable at hello@wapio.in
• Vendor review for critical subprocessors that process Personal Data

• TLS encryption for data in transit
• Authentication for workspace users; role-based permissions for agents and admins
• API keys and webhook signature verification for integrations
• Audit logs on higher-tier plans; logging of administrative actions
• Separation of sandbox / test traffic from production where offered
• Secure handling of Meta tokens obtained via Embedded Signup; tokens stored encrypted at rest where applicable

Production workloads are hosted with reputable cloud providers. We use restricted administrative access, network controls, monitoring/alerting, and backups appropriate to Service criticality. Secrets are managed via controlled secret storage where feasible.

Clients retain ownership and Meta Business Manager control of their WABAs subject to Meta’s terms. Message delivery infrastructure operated by Meta is secured under Meta’s controls. wapio processes events and content necessary to provide inbox, APIs, templates, and automations per Client configuration.

• Business Solution Data processed only on Client instructions for providing the Service
• No sale of Personal Data or Business Solution Data
• No profiling of WhatsApp End Users from Business Solution Data beyond operating Client message threads
• AI training restrictions as described in our Privacy Policy and Terms
• Deletion workflows documented at Data Deletion Instructions

We investigate suspected security incidents affecting the Service. Where a personal data breach affecting Client data requires notification under applicable law, we will notify affected Clients without undue delay and provide information reasonably available to help Clients meet their obligations.

• Protect agent accounts with strong passwords and limit seat access
• Secure webhook endpoints and rotate secrets
• Keep Meta Business Manager admins accurate and remove departed staff
• Configure retention appropriate to your industry and legal duties
• Report suspected compromise immediately to hello@wapio.in

If you believe you have found a security vulnerability in wapio, email hello@wapio.in with subject “Security Vulnerability”. Please include steps to reproduce and avoid accessing other customers’ data. Do not publicly disclose until we confirm a fix or coordinated disclosure timeline.

Formal third-party certifications (e.g., ISO 27001, SOC 2) may be pursued as we scale. Absence of a named certificate does not mean absence of controls; Meta may request descriptions and evidence of protections during Tech Provider / access verification processes, which we will provide in good faith.

Techspence Private Limited
Techspence, Room No 10, First Floor, Park Centre, KINFRA Techno Industrial Park, Kakkanchery, Malapuram, Kerala, 673634
hello@wapio.in · 9061990080