Bank-grade security. In plain English.

1. Infrastructure

• Hosted on AWS Mumbai (ap-south-1) — data stays in India.
• Multi-AZ deployment with automatic failover.
• Immutable infrastructure — servers are rebuilt from source, never patched by hand.
• All infrastructure changes go through code review + automated tests before deploy.

2. Encryption

• At rest — AES-256 for all databases, object storage and backups.
• In transit — TLS 1.3 for every connection. HSTS enforced.
• Encryption keys managed via AWS KMS with automatic annual rotation.
• Message content between you and Meta WhatsApp is transported over their end-to-end-encrypted channel.

3. Access control

• Role-based access control (RBAC) — Owner, Admin, Agent, Read-only.
• SSO via Google & Microsoft for Enterprise plans.
• Two-factor authentication (2FA) available on every plan, required on Enterprise.
• Team member sessions expire after 24h of inactivity.
• Every admin action is written to an immutable audit log.
• Employee access to customer data requires just-in-time approval and is logged.

3a. Team roles & permissions

Give every teammate exactly the access they need — nothing more, nothing less. Permissions are enforced on every API call, not just the UI.

• Owner — billing, team, workspace deletion. One per account.
• Admin — manage templates, integrations, flows, API keys and all team members except owner.
• Agent — reply in the inbox, send broadcasts to approved audiences, use quick replies and labels.
• Read-only — view analytics, dashboards and chat history. Cannot send, delete or edit.
• Custom roles (Enterprise) — compose permissions from a 40-item matrix per module.

Invites are sent via email with a 7-day expiry. Pending invites can be revoked instantly; role changes take effect on the next request.

3b. Audit log

Every sensitive action is written to an append-only audit log — accessible from Settings → Audit, and exportable to CSV or your SIEM.

• Who did what, when, from which IP and user-agent.
• Covers logins, template edits, broadcast sends, API key issue/revoke, role changes, data exports and webhook config changes.
• Immutable — rows cannot be edited or deleted, even by owners.
• 365 days of retention on all plans; 7 years on Enterprise for DPDPA / SOC 2 evidence.
• Filter by actor, action, resource or date range. Save a filter as a scheduled weekly digest.

4. Network security

• Private VPC — application servers are not directly reachable from the internet.
• WAF (Web Application Firewall) with OWASP Top-10 rules in front of every endpoint.
• DDoS protection via AWS Shield Standard.
• Rate-limiting on all API endpoints to prevent abuse.

5. Monitoring & incident response

• 24×7 automated monitoring with pager alerts to the on-call engineer.
• Structured logging & anomaly detection.
• Live status published to status.html — updated every 60 seconds.
• All incidents get a public post-mortem within 5 business days.
• Severity-1 incidents get customer email + WhatsApp notifications within 30 minutes.

6. Backups & recovery

• Point-in-time database backups every 5 minutes.
• Encrypted backups retained for 30 days, replicated across AWS availability zones.
• Quarterly disaster-recovery drills. Target RTO: 4 hours. Target RPO: 15 minutes.

7. People & training

• All employees sign NDAs and complete security training on joining, then annually.
• Background checks for anyone with production access.
• Least-privilege principle — access is granted only for the specific task, revoked when done.
• Mandatory MFA on all employee accounts, hardware-key required for engineers.

8. Compliance & certifications

We build to standards our largest customers require:

• India DPDPA 2023 — compliant, with a designated Data Protection Officer.
• GDPR-aligned — data subject rights, DPAs, EEA transfer safeguards.
• SOC 2 Type I readiness — controls in place; formal audit planned for Q4 2026.
• Meta Business Solution Provider — vetted by Meta for WhatsApp Business API.

Enterprise customers can request signed DPAs, security questionnaires (CAIQ, SIG-Lite) and penetration-test summaries.

9. Responsible disclosure

Found a security issue? We want to hear about it. Email techorasolution@gmail.com with:

• A description of the issue.
• Steps to reproduce.
• Your name or handle (for credit, if desired).

We commit to acknowledging within 24 hours, fixing high-severity issues within 7 days, and thanking you publicly in our security hall of fame (opt-in).

10. Contact

General security questions: techorasolution@gmail.com