Security & Compliance
Last Updated: September 09, 2026
Wassel is dedicated to upholding the highest enterprise security, encryption, and privacy standards as an independent software application built using Meta's official WhatsApp Business Cloud API. This document outlines our architectural security controls and compliance practices.
1. Meta Platform & Cloud API Policy Compliance
- Direct Cloud Routing: All WhatsApp interactions are transmitted directly to official Meta Cloud API endpoints. We never use unauthorized QR-code web wrappers or reverse-engineered scraping tools.
- Zero Ban Risk Architecture: Operating strictly through Meta's verified API channels ensures registered business numbers remain compliant with WhatsApp Business Messaging Policies.
- Message Template Pre-Approval: Interactive transactional and marketing templates undergo rigorous Meta approval before broadcast.
2. Data Encryption in Transit & at Rest
- TLS 1.3 Transport Security: All client, webhook, and Graph API requests are encrypted end-to-end using modern TLS 1.3 cipher suites.
- Cryptographic Webhook Verification: Every inbound Meta webhook payload is authenticated using HMAC-SHA256 signature verification and timing-safe
hash_equals()validation before acceptance.
3. Strict Multi-Tenant Data Isolation
Wassel implements strict logical tenant separation. Every data transaction and lookup is permanently scoped by the authenticated project_id, guaranteeing absolute isolation between merchants and business accounts.
4. Key Management & Credential Sanitization
- Encrypted Tokens: System user access tokens and webhook security secrets are stored with AES-256 encryption.
- Zero Log Exposure: Sensitive authentication keys, OAuth credentials, and PINs are stripped and never written to persistent application logs.
5. Regulatory & Privacy Alignment
Wassel conforms to regional and international data protection standards (including PDPL and GDPR). Organizations retain complete sovereignty over their data and may disconnect services or initiate automated data purging at any time via support@wassel.app.