Trust

Trust and security

Last updated: 26 September 2026

walpio sends your business's WhatsApp messages with your Meta credentials, so you should know how they are protected. This page says what the service does today — and, as plainly, what it does not do yet.

How data is protected

• Your Meta credentials are encrypted. The access token and app secret you give us for your number are sealed with AES-256-GCM, each with its own random value, before they are stored; the key is held as a secret of the service, not in its database. The secret we sign your callbacks with, and our operators' two-factor keys, are sealed the same way.
• Passwords and API keys are stored only as hashes. An API key is shown once, when it is made; it can be given an expiry date and revoked at any time. Dashboard sign-ins are limited per address and per account, and a signed-in session lives in a cookie scripts cannot read.
• Every message from Meta is checked. Each event Meta sends is verified against its signature, made with your app secret, before walpio acts on it. The status reports we post to your server are signed too, so your server can check they came from walpio.
• Each workspace sees only its own data. Every request is tied to one workspace. An automated test aims every route of the API at another workspace's data, and fails if anything crosses over; it runs on every change to the code.
• The website and the dashboard are locked down in the browser. They run under a strict Content-Security-Policy — scripts only from our own files, each inline script allowed by its exact fingerprint — cannot be shown inside another site's frame, and are served only over HTTPS.
• Changes are recorded. The activity log records who changed what in a workspace, and when, including changes a walpio operator makes on your behalf, and the IP address of each change made in the dashboard or by an operator. Your workspace's admins can read it on the dashboard's Activity page.
• Problems can be traced. Every answer from the API carries an X-Request-Id header, and every error ends with its request_id: quote it when you write to us and we can find that exact request.
• Access to production is limited to the people who operate the service. Our operators sign in to a separate console, which offers two-factor sign-in with an authenticator app.

Backups and monitoring

• Nightly backups. A copy of the database is written every night to Cloudflare R2 storage, apart from the database itself, and kept for 35 days. Credentials stay encrypted inside it.
• A tested restore. The restore procedure is written down step by step, and an automated test restores a backup into an empty database and checks that the workspace works again. It runs on every change to the code.
• Checks every 15 minutes. The service watches itself: a number Meta reports as failing, a template that is paused or rejected while in use, sends that fail or are refused more than usual, status reports your server keeps turning away, and a backup that did not happen. Each raises an alert for walpio's operators, on a board of everything that needs attention.

The API also publishes a public health check: api.walpio.com/health.

Where data lives, and for how long

walpio runs on Cloudflare's global network. Its database and backups are Cloudflare's, and are not pinned to one country, so data may be processed and stored outside yours. Meta delivers the messages under your own Meta account and its own terms. If you want message content at rest in the UAE, Meta can keep it there when you switch on its local storage before your number is registered — our connection guide shows how. That setting covers what Meta stores, not walpio's own records.

We keep message details and a preview of up to 160 characters, not an archive of conversations. The full text of a message is held only while a send is being retried and, for a customer's message, in the log of the status reports we post to you. How long each kind of data is kept:

You can ask for an export of your workspace's data, or its erasure, at [email protected]. Erasure revokes the workspace's API keys and signs everyone out at once, then deletes its records; the activity log expires on its own schedule, and backups roll off within 35 days. The Privacy Policy has the full detail.

Sub-processors

The companies that process data for walpio, and what each does:

Apart from Cloudflare's e-mail forwarding, walpio uses no e-mail sending service today. If one is added — for sign-in or invitation e-mails — it will be listed here before it handles any data. The same list is in section 4 of the Privacy Policy; the date at the top of each page shows when it last changed, and clients are told by e-mail of a change that materially affects how we handle their data.

Reporting a security problem

If you think you have found a security problem in walpio.com, the dashboard or the API, write to [email protected] with “Security” in the subject, and tell us what you found and how to reproduce it. We reply to every report, usually within one business day. Please do not access or change other people's data, do not disrupt the service, and give us time to fix the problem before you tell anyone else. The same contact is published in the standard /.well-known/security.txt file.

Not yet, and coming

• Coming: who provides walpio. The name, registered address and registration details of the company that provides walpio will be published here, in the Terms and in the Privacy Policy.
• Coming: a data processing agreement (DPA) for clients, setting out how walpio processes their customers' data on their behalf. Until it is published, write to [email protected] with what your organisation needs.
• Not yet: two-factor sign-in for workspace users. Today only walpio's operators can use it.
• Not yet: a status page with incident history. Today there is the public health check above.
• Not yet: a security certification such as ISO 27001 or SOC 2.