Security

Last updated: October 22, 2026

Security is fundamental to Waslo. We handle sensitive business communications and lead data, and we take that responsibility seriously. Here is how we protect your data.

Encryption

In Transit

All communication between your browser and Waslo is encrypted using TLS (HTTPS). API requests, authentication tokens, and all data transfers are encrypted in transit.

At Rest

Sensitive data — including channel authentication state (WhatsApp sessions, OAuth refresh tokens for Outlook / Google Calendar / Meta, Telegram bot tokens) and third-party integration credentials — is encrypted at rest using industry-standard authenticated encryption before storage.

Authentication and Access Control

  • Token-Based Authentication — all API requests are authenticated using secure tokens with configurable expiration.
  • Password Hashing — passwords are hashed using strong, salted hashing algorithms before storage.
  • Two-Step Verification (optional) — any user can turn on codes from an authenticator app (Google Authenticator, Microsoft Authenticator, 1Password and others) in Settings → Account. Once on, it is asked for after every sign-in method — password, Google or Apple — on the website and in the iOS app. Each code works once, wrong codes are limited per account, and ten one-time recovery codes cover a lost phone.
  • OAuth Support — Google, Apple and GitHub sign-in provide additional secure authentication options.
  • Sign-In Protection — an account locks for 15 minutes after repeated wrong passwords, and the "forgot password" and verification forms answer the same way whether or not an email is registered.
  • One-Time Links Stored Hashed — password-reset, email-verification and team-invitation links are stored only as a hash, so a copy of the database never contains a working link.
  • Rate Limiting — API endpoints are protected with rate limiting to prevent brute-force and abuse attacks.
  • Security Headers — we enforce security-focused HTTP headers including Content Security Policy, X-Frame-Options, and others.

Multi-Tenant Data Isolation

Waslo is a multi-tenant platform. Every data query is scoped by organization, extracted from the authenticated session. This ensures that one organization can never access another organization's data — including leads, conversations, configurations, and integrations.

Security Monitoring

Waslo keeps a security audit trail of refused and suspicious requests: attempts to read or change another workspace's data, webhooks that fail their signature check, links that point into our own network, failed sign-ins and two-step codes, invalid API keys and bursts of refused requests. Bursts from one address are grouped rather than logged one by one. High-severity events alert our team as they happen, and a daily summary is reviewed. The trail keeps no message content, passwords or tokens, and is deleted after 180 days.

Infrastructure

Our platform is hosted on enterprise-grade cloud infrastructure with:

  • Automatic HTTPS and DDoS protection
  • Global CDN for fast, reliable access
  • Network isolation between services
  • Encrypted database connections and regular backups
  • Private networking for internal service communication

Application Security Practices

  • Input validation on all API endpoints to prevent injection attacks
  • CORS restrictions to prevent unauthorized cross-origin requests
  • Idempotency checks on message processing to prevent duplicate handling
  • No default credentials — all administrative access requires explicit configuration
  • Encrypted message queue processing for reliable, secure data flow

Website Chat

  • Hashed visitor tokens — the token that reconnects a visitor to their conversation is stored on our side only as a SHA-256 hash.
  • Listed websites only — the widget answers only on the website addresses the business has listed; requests from any other origin are refused.
  • Bot check — Cloudflare Turnstile runs when a visitor first opens the chat.
  • Separate domain — the widget is served from waslo.org, apart from the waslo.io dashboard, so it never shares cookies or sessions with it.

Website Crawler

  • Identifies itself as WasloSiteBot/1.0 and follows robots.txt.
  • Reads only public HTTPS pages on the same site, and refuses private network addresses.
  • Up to 3 scans per workspace per day; the business reviews pages before anything is imported.

What We Don't Do

  • We do not store raw channel credentials — every WhatsApp session, OAuth token, and bot token is encrypted at rest
  • We do not share your data with third parties for advertising purposes
  • We do not use your conversation data to train AI models

Independent Review

Waslo is reviewed by the platforms it integrates with, and by adversarial audits of our own code.

  • Microsoft — verified publisher (29 May 2026). Outlook access is built on Microsoft Graph.
  • Google — OAuth verification passed (8 June 2026). Calendar scopes only; we never request mailbox scopes we do not use.
  • Meta — App Review approved, app published (30 June 2026). Covers WhatsApp Cloud API, Instagram and Messenger messaging permissions.

In July 2026 we ran two adversarial security audits of the public API surface. Both rounds found issues, and both sets were fixed and covered by regression tests before release — including a server-side request forgery bypass, an unsigned OAuth state parameter, and a credit-deduction race condition. We publish this because an audit that finds nothing is usually an audit that did not look.

Where Your Data Lives

  • Application and database — hosted on managed cloud infrastructure in the EU, with encrypted connections, private networking and automated backups.
  • Sub-processors — we use a small set of named providers for hosting, database, queueing, transactional email, media storage, error monitoring, payments and website-chat bot checks (Cloudflare Turnstile). Each is bound by its own data-processing terms. The current list is published in our Privacy Policy and referenced by our Data Processing Agreement.
  • AI processing — message content is sent to the model provider to generate a reply. It is not used to train their models.

Retention and Deletion

  • You can delete your account from the dashboard at any time; deletion removes your organisation's data on a 30-day schedule.
  • Conversation and lead data is retained while your account is active, because the product needs it to answer with context.
  • Anonymous website chat visitors are deleted on the schedule the business chooses (30 to 365 days after their last message, 180 by default), and website scan results after 30 days.
  • Ephemeral artefacts — hosted voice audio, media links, rate-limit counters — expire automatically, typically within minutes.

What We Do Not Claim

We are not SOC 2 or ISO 27001 certified, we do not hold HIPAA or PCI attestations, and we do not offer single sign-on (SSO or SAML) yet. We are a small team building on audited infrastructure, and we would rather tell you that than imply a certification we have not earned. If your procurement process requires one, tell us before you buy.

Reporting Security Issues

If you discover a security vulnerability, please report it responsibly by emailing hello@waslo.io with the subject line "Security Report". We take all reports seriously and will respond promptly.