Our approach
ChatDaddy handles WhatsApp Business credentials and live customer conversations for every tenant, so security is a product requirement, not an afterthought. This page covers the concrete controls in place today and how to reach us if you find a problem.
TLS 1.3 in transit (1.2 minimum for legacy clients). AES-256-GCM at rest, KMS-managed keys.
Argon2id for passwords. HMAC-SHA256 for refresh tokens and webhook signatures.
Postgres row-level security plus tenant-scoped indexes on every table that holds customer data.
Every inbound Meta webhook is verified against its HMAC SHA-256 signature before we act on it.
Encryption
- TLS 1.3 in transit for all traffic, including Meta webhooks and API calls.
- AES-256-GCM at rest for the database and object storage, with keys managed by our cloud KMS.
- WhatsApp access tokens and API keys are encrypted at rest and never returned in full by the API once issued.
Tenant isolation
Every table holding customer data (contacts, messages, flows, analytics events) is scoped by tenant ID and enforced with Postgres row-level security in addition to application-layer checks, so a bug in one query path can’t cross a tenant boundary. Isolation is exercised in CI on every change.
Access control
Internal access to production data is role-based, logged, and limited to what’s needed to operate the service or resolve a specific support request. Workspace-level roles (Owner, Admin, Manager, Agent, Viewer) let tenants scope what their own users can see and do inside a workspace.
Infrastructure & webhooks
The platform runs as isolated services behind an API gateway, with all inbound Meta webhook traffic verified against its HMAC signature before processing. Secrets are stored in the hosting provider’s managed secret store, not in source control.
Reporting a vulnerability
Email security@chatdaddy.io with a clear description, reproduction steps, affected endpoints, and any proof-of-concept payload. We acknowledge within 2 business days and keep you updated until resolution. We won’t pursue researchers acting in good faith under this policy — please avoid accessing other tenants’ data beyond what’s needed to demonstrate the issue.
Bug bounty
We don’t run a public paid bounty program yet. Until we do, reports go through the disclosure process above, and we credit researchers publicly on request.
Incident response
Confirmed security incidents affecting customer data are triaged immediately, and affected tenants are notified without undue delay with the information they need for their own regulatory obligations — consistent with the breach notification commitment in the DPA.
Compliance roadmap
Current certifications and target dates are tracked on the Trust Center, alongside our full document set.