Security and data protection
WYP.chat connects to WhatsApp through Meta’s official API, never through WhatsApp Web. Each company’s data is isolated in the database, two-factor authentication is mandatory for owners, administrators and supervisors, permissions are enforced by the server and every sensitive action goes into an audit log. The database is hosted in Frankfurt.
- Meta’s official API
- Isolated workspaces
- Two-factor authentication
- Passkeys
- Server-side roles
- Audit log
- Encrypted tokens
- Database in the EU
WhatsApp through Meta’s official API
WYP.chat does not automate WhatsApp Web or emulate a phone. Your number is connected through Meta’s own sign-up flow, with your Meta account.
- Connection you authorise
- The number is connected from WYP.chat, in a Meta window; while Meta reviews WYP.chat, our team sets up this connection with you. You can disconnect it from WYP.chat or remove access on Meta’s side.
- Authenticated incoming messages
- Every notification from Meta is checked against its signature before processing, then stored encrypted. The raw content is deleted after 7 days.
- What goes through Meta
- WhatsApp, Instagram and Messenger messages travel through Meta’s infrastructure, which delivers them. That is true of any tool on the official API. Your company has its own agreement with Meta.
Every company in its own workspace
Your data is kept apart from other customers’ data by the database itself, not just by application code.
- Row-level security
- PostgreSQL filters every table holding customer data by workspace (Row-Level Security enabled and forced). The application connects with a role that cannot bypass that filter.
- Two barriers
- The code filters by workspace too. A resource from another workspace returns “not found”, without revealing that it exists.
- Files
- Photos, voice notes and documents are stored in the European Union and only served after checking the signed-in person’s permissions.
- Tested on every change
- Automated tests check that one workspace never sees another’s data. They run on every code change, along with static analysis and a dependency audit.
Sign-in and accounts
A team account opens every conversation the company has, so sign-in is protected accordingly.
- Two-factor authentication
- Mandatory for owners, administrators and supervisors: a 6-digit code from an authenticator app, with backup codes. After 5 wrong codes, the account is locked for 15 minutes.
- Passkeys
- Sign in with Touch ID, Face ID or a fingerprint, with user verification required. An email alerts you whenever a new passkey is added.
- Passwords
- At least 12 characters, rejected if they appear in a known breach (Have I Been Pwned), stored as a hash. The email address is verified before the first sign-in.
- New device
- An email alerts you when your account signs in from a new device. Sign-in attempts are rate-limited.
- Sessions
- Secure cookie, out of reach of page scripts. Sessions expire after 12 hours of inactivity.
Roles and permissions enforced by the server
Five roles: owner, administrator, supervisor, member and viewer. The interface hides what is not allowed, and the server refuses it on every request.
- Visibility by team
- Once a number is linked to teams, only their members see its conversations, unless an administrator turns on global visibility.
- Least privilege
- Only the owner and administrators export data, manage members and read the audit log. Only the owner manages the subscription.
- Four-eyes approval
- A supervisor drafts message templates and campaigns; an administrator approves them before they are sent.
Audit log and technical logs
You know who did what, and technical logs do not contain your conversations.
- Append-only audit log
- Invitations, role changes, numbers connected or disconnected, templates, exports, escalations, integrations: every sensitive action is recorded. The database forbids editing or deleting an entry.
- Available to you
- The owner and administrators can read it in the workspace settings.
- Security log
- Sign-ins, failures, two-factor events and passkeys are logged separately, with IP address and browser.
- Masked technical logs
- Never any message content or token. Phone numbers and email addresses are masked automatically.
Encryption
The secrets that unlock your accounts are never stored in plain text.
- In transit
- HTTPS everywhere, with HSTS and browser preloading.
- Access tokens
- Meta, Slack and Google tokens, the Telegram bot token and Ringover, Calendly and Cal.com keys encrypted with AES-256-GCM, using a key derived for each workspace. A copy of the database alone does not reveal them.
- In the browser
- A strict Content Security Policy, protection against cross-site request forgery, and the app cannot be embedded in a frame.
Where your data lives
Your database and files are in the European Union. WhatsApp, Instagram and Messenger messages, however, travel through Meta: no tool on the official API can promise they stay in one country.
| Data | Location | Provider |
|---|---|---|
| Contacts, conversations, settings | Frankfurt, Germany (EU) | Neon (PostgreSQL) |
| Photos, voice notes, documents | European Union | Cloudflare R2 |
| Application and processing | Cloudflare’s global network | Cloudflare Workers |
| Delivery of WhatsApp, Instagram and Messenger messages | EU and United States | Meta Platforms Ireland |
| Outgoing emails | EU region | SparkPost (Bird) |
Sub-processors
The providers that process data to run WYP.chat. Some are only involved if you turn on the related feature.
| Provider | Purpose |
|---|---|
| Cloudflare | Application hosting, files, processing queues, real time; voice note transcription if the AI agent is on. |
| Neon | PostgreSQL database, in Frankfurt. |
| Meta Platforms Ireland | WhatsApp Business, Messenger and Instagram. |
| SparkPost (Bird) | Verification, invitation and alert emails, and replies sent by email, with no open or click tracking. |
| Stripe | Payment of the subscription and credits. |
| Anthropic | AI features, only if your workspace uses them. |
| Slack | Alerts, if your workspace connects Slack. |
| Calendar, Meet and Contacts, if a member links their Google account. | |
| Telegram | Messages from your Telegram bot, if your workspace connects it. |
| Ringover | Calls and missed calls, if your workspace connects Ringover. |
| Calendly and Cal.com | Appointments booked on your booking page, if your workspace connects either of them. |
| Browser push services | Notifications on members’ devices; their content is end-to-end encrypted. |
How long we keep your data
Periods taken from our privacy policy. The owner and administrators can export contacts at any time.
Privacy policy → Set the message retention period →- Raw data received from Meta
- 7 days, then deleted automatically.
- Messages and files
- 24 months by default, then deleted automatically. The owner or an admin can choose 12 or 6 months, with a 7-day delay before the first deletion.
- Contacts, consent and refusals
- For as long as the workspace is active or until deleted, and no more than 30 days after it is closed. Consent records, refusals (STOP, blocks) and the audit log stay when messages are deleted.
- Security and audit logs
- For as long as the account or workspace exists, and no more than 30 days after it is closed.
- Database backups
- On their own cycle, no more than 30 days.
A question, or a vulnerability to report?
Email hello@wyp.agency with a security question, a questionnaire to complete or a vulnerability report. Please do not disclose a vulnerability publicly before we reply.
hello@wyp.agency →Security questions
Are my WhatsApp messages hosted in the EU?
Your database is in Frankfurt and your files are in the European Union. Messages also travel through Meta’s infrastructure, in the EU and the United States, as with any tool on the official API.
Does WYP.chat use WhatsApp Web?
No. WYP.chat uses Meta’s official API, designed for businesses. It does not automate WhatsApp Web or a phone.
Is my conversation content used to train AI?
No. Our privacy policy rules it out, and we do not sell any data.
What happens if an administrator loses their phone?
They sign in with one of their backup codes, then set up two-factor authentication again on the new phone.
Learn more
A team inbox on the official API, with your data kept apart.
Message us on WhatsApp While Meta reviews WYP.chat, our team connects your WhatsApp number with you.