Official onboarding only
Numbers connect through Meta’s embedded signup. No grey-market BSP sits between you and Meta.
Your WhatsApp Data,
Handled Like It Matters.
WBIZ runs on Meta’s official WhatsApp Cloud API with workspace isolation enforced in the backend, secrets encrypted at rest, HMAC-signed webhooks and an audit log that is on by default rather than sold as an upgrade.
Official Meta Cloud APIHMAC-signed webhooksAudit log on by defaultDPDP and GDPR aligned
Backend-enforced isolation
Every data read is filtered by workspace on the server, so tenants cannot see each other’s conversations.
Encrypted secrets
Tokens, credentials and key secrets are encrypted at rest and revealed once at creation.
Provable events
Outbound webhooks are HMAC-signed, retried with backoff and replayable from the dashboard.
Authentication and secrets
Bank-grade auth, and secrets you only see once
Sessions are short-lived and refreshed, API keys carry per-key scopes, and a key secret is revealed exactly once at creation. Nothing sensitive is stored in plain text, and every key can be rotated or revoked without downtime.
- Short-lived sessions with refresh, not long-life tokens
- Per-key scopes so an integration gets only what it needs
- Reveal-once secrets with instant rotation and revocation
- Flow payloads use per-account RSA and AES encryption
- Server-side SSRF guards on outbound HTTP actions
API keywbz_live_••••_4f21reveal once
messages:sendgranted
contacts:readgranted
campaigns:writegranted
billing:readdenied
workspace:deletedenied
Rotating a key takes effect immediately and is written to the audit log.
Event integrity
Signed, retried, replayable
Every outbound event is signed with HMAC-SHA256 so your systems can prove it came from us. Failures retry with backoff, land in a dead letter queue if they exhaust, and can be replayed with one click. Inbound Meta and Razorpay webhooks are verified against the raw request bytes before anything is trusted.
- Versioned envelope so payload changes never break you
- Filter which events each subscription receives
- Delivery history with response codes and timings
- Test-fire any event from the dashboard
Webhook deliverysigned with HMAC-SHA256
EventAttemptTimeState
message.statusattempt 182msdelivered
conversation.updateattempt 194msdelivered
campaign.finishedattempt 31.2sretried
contact.createdexhausted—in DLQ
Dead letter queue 1 · retries exponentialReplay event
Access control
Agents get the inbox.
Admins get the keys.
Roles gate billing, settings and deletion, so a front-line agent can work every conversation without touching anything that costs money or leaks data.
CapabilityOwnerAdminAgentRead only
Work conversations in the inboxYesYesYesView
Send campaignsYesYesScopedNo
Manage templates and flowsYesYesNoNo
Create and rotate API keysYesYesNoNo
Billing and plan changesYesNoNoNo
Export or delete workspace dataYesNoNoNo
Isolation, logging and data control
Three things buyers always ask,
answered plainly.
Workspace isolation
Multi-tenancy is the default, not a higher tier. Several WABA numbers can live under one login with per-number filtering.
- Server-side filtering on every query
- Per-number views for agencies
- No shared credentials between tenants
Always-on audit
Activity logs record every change across the product so admins can answer what happened and when.
- Queryable by user, date and area
- Covers settings, keys and deletions
- Included on the plan
Consent and data rights
Consent is tracked per contact with source and history, and privacy requests are supported end to end.
- Opt-out keywords cancel pending sends
- Workspace export on request
- Account and contact deletion
Security FAQ
What security teams ask us
Send your questionnaire and we will return it completed. For data-protection specifics, see Trust and Compliance.
Messages are delivered by Meta’s Cloud API and stored against your workspace in our database. Access is filtered server-side by workspace, so isolation is enforced by the backend rather than by the interface.
Traffic is encrypted in transit with TLS, and credentials, tokens and API key secrets are encrypted at rest. Key secrets are shown once at creation and can be rotated at any time.
Every inbound Meta and Razorpay webhook is verified with HMAC-SHA256 against the raw request bytes before the payload is parsed or trusted.
Yes. Roles and permissions gate billing, settings, exports and deletion. Agents can work conversations without reaching admin surfaces, and multi-number workspaces can be filtered per number.
Yes, always on. Activity logs record who did what and when across the workspace, and admins can query them to reconstruct an incident.
Yes. Workspace export and account or per-contact deletion are supported for privacy requests, with consent state tracked per contact.
Yes. Send yours through the contact form and we will complete and return it.
Security review before you commit?
Send the questionnaire, the NDA or the architecture questions. You will get written answers, not a brochure.