Security Policy

1. Encryption

• In transit: Production traffic uses HTTPS/TLS. Calls between the WatsBerry app, Supabase Edge Functions, Meta/WhatsApp, Shopify, Google, Slack, and other Customer-configured providers are encrypted in transit.
• Secrets at rest: Sensitive integration credentials are encrypted with AES-256-GCM before storage, including WhatsApp Business API access tokens, Shopify access tokens, and Google Calendar OAuth refresh/access tokens. Google Calendar credentials are stored in a service-role-only table and are not exposed to browser clients.
• Database at rest: Application database volumes are encrypted at rest by our cloud provider (Supabase / PostgreSQL on AWS).
• Backups: Database backups are managed by the hosting provider and inherit the same at-rest encryption standards. Backup access is limited to authorized infrastructure operations.

2. Access Control

• Tenant isolation: Row-level security (RLS) scopes Customers’ data (subscribers, conversations, campaigns, appointments, integrations configuration, and related records) to their organization.
• Role-based access: Organization roles (for example admin, manager, agent) limit what team members can do within a tenant.
• Platform staff: Internal platform administrator access is limited to a small set of authorized personnel on a need-to-know basis for support, billing, and security operations.
• Passwords: Account passwords are hashed by our identity provider (Supabase Auth), we never store plaintext passwords in application databases. Passwords must be 8–20 characters and include letters and numbers. Password reset uses one-time email links with rate limiting and a fixed redirect URL to reduce takeover and enumeration risk.
• Official messaging channels: WhatsApp connects through Meta Embedded Signup / the official WhatsApp Business Platform. We do not use unofficial WhatsApp clients.

3. Application Security Controls

• Phone-scoped order lookups: Where Customers enable WhatsApp order status, lookups are scoped to the End User’s WhatsApp number so guessing another order ID does not reveal another customer’s order.
• Webhook integrity: Shopify and payment-provider webhooks use signature / HMAC verification where the provider supports it.
• AI knowledge grounding: Bot FAQ answers are intended to be grounded in Customer-provided knowledge. Free-form AI is not used as a substitute for authenticated commerce lookups.
• Internal workers: Privileged Edge Function actions that must not be Customer-callable are gated by internal authentication secrets.
• Least privilege for OAuth: Google Calendar uses platform-owned OAuth client credentials with Calendar scopes needed to create and manage booking events for the connected calendar. Slack uses Customer-provided Incoming Webhook URLs scoped to the Customer’s chosen channel.

4. Access Logging

We maintain audit records for security-sensitive actions, including:

• Platform administrator access to admin consoles and cross-tenant views.
• Integration connect / disconnect events (WhatsApp, Shopify, Google Calendar, Slack, and other Customer-configured integrations where logged).
• Authentication events via our identity provider.
• WhatsApp identity and compliance-related events where applicable.

Logs are retained for a limited period sufficient for security investigation and compliance, then deleted or aggregated.

5. Data Retention

We retain personal data only as long as needed to provide the Services, meet legal obligations, and resolve disputes. Plan-based analytics retention limits apply where configured. Conversation archives may be retained per organization settings (default archive retention: 90 days where enabled). Appointment records created from WhatsApp forms are retained with the Customer’s organization until deleted or the organization is removed. Customers may delete subscribers, conversations, and disconnect integrations through the platform; disconnecting Google Calendar removes stored Calendar OAuth tokens for that organization.

6. Environment Separation

Production customer data is hosted in a dedicated production Supabase project. Local development uses separate environment configuration and must not use production database credentials. Staging or test environments, when used, are isolated from production and must not contain live merchant personal data except anonymized fixtures.

7. Data Loss Prevention

Our data loss prevention approach includes:

• Least-privilege access to production systems and secrets.
• Encrypted storage of high-sensitivity API tokens and OAuth secrets (not stored in plaintext in application source code).
• Org-scoped storage of Customer-provided Slack Incoming Webhook URLs and other integration configuration, protected by tenant RLS.
• Webhook HMAC / signature verification for Shopify and payment providers.
• Regular automated backups with provider-level redundancy.
• Monitoring of critical service health and error rates.

8. Security Incident Response

If we confirm a security incident affecting personal data:

1. Contain: isolate affected systems, revoke compromised credentials, block malicious access.
2. Assess: determine scope, data categories, and affected merchants / End Users.
3. Notify: inform affected Customers without undue delay where required by law or contract; cooperate on regulator notifications when applicable.
4. Remediate: fix root cause, rotate secrets, patch vulnerabilities.
5. Review: document lessons learned and update controls.

Report suspected incidents to [email protected] with subject line “Security Incident”. We aim to acknowledge reports within 2 business days (India Standard Time). Customers outside India may report at any time.

9. Vendor & Sub-processor Security

We evaluate infrastructure providers for security certifications and contractual data protection obligations. Primary processors and interconnected platforms include Supabase, Vercel, Meta / WhatsApp, Google (Calendar OAuth / Calendar API where Customers connect Calendar), Slack (Incoming Webhooks where Customers connect Slack), Shopify (where Customers connect a store), and payment gateways configured by Customers (for example Razorpay in India, or another provider you connect in your country). Customers remain responsible for the accounts and data they authorize those providers to process.

10. Customer Responsibilities

• Protect account credentials and limit team roles appropriately.
• Promptly report unauthorized access or suspected compromise of WatsBerry, Meta, Shopify, Google, or Slack credentials used with the Service.
• Connect Google Calendar only with the Google account that should own booking events; disconnect Calendar when staff change or the calendar should no longer receive bookings.
• Treat Slack Incoming Webhook URLs as secrets; rotate or revoke them in Slack if exposed, then update WatsBerry.
• Obtain End User consents and comply with Meta / WhatsApp messaging policies, applicable privacy and electronic-marketing law in every country you message, and lawful basis requirements for messaging and marketing.
• Keep Meta Business payment methods funded; Meta bills WhatsApp usage separately from WatsBerry plans and wallet fees.