Security

Last updated: August 12, 2026

Security is fundamental to Waslo. We handle sensitive business communications and lead data, and we take that responsibility seriously. Here is how we protect your data.

Encryption

In Transit

All communication between your browser and Waslo is encrypted using TLS (HTTPS). API requests, authentication tokens, and all data transfers are encrypted in transit.

At Rest

Sensitive data — including channel authentication state (WhatsApp sessions, OAuth refresh tokens for Outlook / Google Calendar / Meta, Telegram bot tokens) and third-party integration credentials — is encrypted at rest using industry-standard authenticated encryption before storage.

Authentication and Access Control

  • Token-Based Authentication — all API requests are authenticated using secure tokens with configurable expiration.
  • Password Hashing — passwords are hashed using strong, salted hashing algorithms before storage.
  • OAuth Support — Google and GitHub sign-in provide additional secure authentication options.
  • Rate Limiting — API endpoints are protected with rate limiting to prevent brute-force and abuse attacks.
  • Security Headers — we enforce security-focused HTTP headers including Content Security Policy, X-Frame-Options, and others.

Multi-Tenant Data Isolation

Waslo is a multi-tenant platform. Every data query is scoped by organization, extracted from the authenticated session. This ensures that one organization can never access another organization's data — including leads, conversations, configurations, and integrations.

Infrastructure

Our platform is hosted on enterprise-grade cloud infrastructure with:

  • Automatic HTTPS and DDoS protection
  • Global CDN for fast, reliable access
  • Network isolation between services
  • Encrypted database connections and regular backups
  • Private networking for internal service communication

Application Security Practices

  • Input validation on all API endpoints to prevent injection attacks
  • CORS restrictions to prevent unauthorized cross-origin requests
  • Idempotency checks on message processing to prevent duplicate handling
  • No default credentials — all administrative access requires explicit configuration
  • Encrypted message queue processing for reliable, secure data flow

What We Don't Do

  • We do not store raw channel credentials — every WhatsApp session, OAuth token, and bot token is encrypted at rest
  • We do not share your data with third parties for advertising purposes
  • We do not use your conversation data to train AI models

Independent Review

Waslo is reviewed by the platforms it integrates with, and by adversarial audits of our own code.

  • Microsoft — verified publisher (29 May 2026). Outlook access is built on Microsoft Graph.
  • Google — OAuth verification passed (8 June 2026). Calendar scopes only; we never request mailbox scopes we do not use.
  • Meta — App Review approved, app published (30 June 2026). Covers WhatsApp Cloud API, Instagram and Messenger messaging permissions.

In July 2026 we ran two adversarial security audits of the public API surface. Both rounds found issues, and both sets were fixed and covered by regression tests before release — including a server-side request forgery bypass, an unsigned OAuth state parameter, and a credit-deduction race condition. We publish this because an audit that finds nothing is usually an audit that did not look.

Where Your Data Lives

  • Application and database — hosted on managed cloud infrastructure in the EU, with encrypted connections, private networking and automated backups.
  • Sub-processors — we use a small set of named providers for hosting, database, queueing, transactional email, media storage, error monitoring and payments. Each is bound by its own data-processing terms. The current list is available on request and is referenced by our Data Processing Agreement.
  • AI processing — message content is sent to the model provider to generate a reply. It is not used to train their models.

Retention and Deletion

  • You can delete your account from the dashboard at any time; deletion removes your organisation's data on a 30-day schedule.
  • Conversation and lead data is retained while your account is active, because the product needs it to answer with context.
  • Ephemeral artefacts — hosted voice audio, media links, rate-limit counters — expire automatically, typically within minutes.

What We Do Not Claim

We are not SOC 2 or ISO 27001 certified, and we do not hold HIPAA or PCI attestations. We are a small team building on audited infrastructure, and we would rather tell you that than imply a certification we have not earned. If your procurement process requires one, tell us before you buy.

Reporting Security Issues

If you discover a security vulnerability, please report it responsibly by emailing hello@waslo.io with the subject line "Security Report". We take all reports seriously and will respond promptly.