WebPingSecurity
Security measures, in concrete.
In transit and at rest
- TLS 1.3 for data moving between your browser, our service, and the WhatsApp API.
- AES-256 encryption at rest for stored credentials and conversation data.
- API keys, database credentials and WhatsApp system tokens live on backend servers — never shipped in the browser bundle.
Webhook integrity
Every webhook from Meta carries an X-Hub-Signature-256 HMAC header over the
exact bytes received. We recompute it with your app secret and reject mismatches before
parsing, so a forged payload never reaches the message pipeline.
Outgoing events to your endpoints are signed with a per-key HMAC-SHA256 over the raw body plus a timestamp, so a captured payload outside its freshness window won't replay.
Scope limits
API keys carry explicit scopes — read:contacts, write:messages,
write:deals, admin:webhooks. A stolen sync key can't send
messages; scopes are additive so a missing one fails at the edge, not inside the workflow.
Revocation takes effect on the next request, with no cache gap.
Internal notes
Internal team notes use a separate channel from customer messages and carry a visibility flag that the WhatsApp delivery pipeline never reads — a team comment can't be sent to a customer by a code path that doesn't exist.
People and process
- Access by role, reviewed quarterly; least-used rights are retired first.
- Audit trail for admin actions in the workspace.
- Report anything suspicious to webping@webpeaker.com.
Security questions go to the same address in writing — you'll get a real answer, not an automated form letter.