WhatSyncs is launching with 3 WhatsApp connections free. Start Free →
Security
WhatSyncs sits between your customer conversations and your business systems, which is a position that deserves specific answers rather than reassuring adjectives. This page describes how the platform actually works today, and says plainly what it does not yet have.
Controls
Every item here describes a control that exists in the platform today.
All API and webhook traffic runs over HTTPS. Endpoints you register must be HTTPS as well.
Webhook payloads can be signed so your systems can verify that an event genuinely originated from WhatSyncs before acting on it.
Every API call is authenticated with a bearer token. Keys are scoped to your workspace and can be rotated or revoked.
Workspaces are logically isolated. Conversations, media and connections belong to one workspace and are queried within that boundary.
Synced media is served through authenticated endpoints rather than public URLs, so a link alone is not enough to read a customer's file.
Delivery logs record what was sent to your endpoints and how it responded, which makes integration incidents diagnosable rather than mysterious.
In practice
Webhook payloads can be signed so your systems can verify that events originated from WhatSyncs. The signature is an HMAC computed over the timestamp and the raw request body using a secret only you and WhatSyncs hold.
That is a meaningful guarantee: without the secret, an attacker who discovers your endpoint URL cannot forge an event your system will accept. Verify before parsing, reject stale timestamps, and compare in constant time.
This is what we mean instead of phrases like “military-grade security”, which describe nothing a buyer can evaluate.
WhatSyncs is designed with security best practices. We do not currently hold SOC 2, ISO 27001 or HIPAA certification, and we are not going to imply otherwise on a marketing page. If a certification is a hard requirement for your procurement process, tell us — it is useful input, and we would rather have that conversation than be discovered later.
For security questions, disclosure or a review before rollout, write to [email protected] .
Conversation data and media are stored by WhatSyncs so they can be synchronized, deduplicated and served through the API. If your policy requires data to reside in a specific region, raise it with us before rollout rather than after.
Access to production data is restricted to what is required to operate and support the platform. We will not pretend that number is zero — support work sometimes requires looking at a specific delivery — but it is limited and purposeful.
Revoke it in the dashboard and issue a new one. Keys are workspace-scoped, so revocation is immediate and does not affect your webhook signing secret, which is a separate credential.
WhatSyncs connects as a linked device to an account you own, in the same way the WhatsApp desktop and web clients do. It reads the conversations that account can already read; it does not weaken or bypass anything for other participants.
Start on the Free plan with a single number, or talk to us about a security review first.