Security Standards

GDPR alignment

Whatslink is built to comply with the GDPR and its UK equivalent. Application data is hosted inside the European Union and never leaves the EU for storage. Access from outside the EU is limited to authorised support and engineering activity and is fully logged.

Encryption

• All connections to the Whatslink website, app and API endpoints are forced over HTTPS (TLS 1.2+).
• Passwords are salted and stored with a modern hashing algorithm — we never see or store your plaintext password.
• HubSpot OAuth tokens and other third-party credentials are encrypted at rest using AES-GCM before they are written to the database.
• Traffic between the WhatsApp bridge, our API and HubSpot is authenticated with per-workspace secrets.

Application security

• Every table with customer data is protected by row-level security, so a workspace can never see another workspace's data.
• Roles inside a workspace (Owner vs. Member) are enforced on the server, not just in the UI.
• The public API endpoints used by the WhatsApp bridge verify a per-workspace webhook secret before accepting any request.
• All backend changes go through code review before they reach production.
• Development, staging and production environments are separated.

Infrastructure

• Database & auth: managed Postgres with automatic daily backups and point-in-time recovery.
• App hosting: served from an edge network with DDoS protection.
• WhatsApp bridge: a hardened Node.js service that only accepts signed traffic from Whatslink.
• Secrets: managed through the hosting platform's secret store; never committed to source control.

Access control

• Production access is limited to a small number of engineers.
• All admin actions on customer workspaces are audit-logged.
• Multi-factor authentication is required for every internal system that touches customer data.

Incident response

If we ever suspect a security incident that affects customer data, we will investigate immediately, contain the issue and notify affected customers by email without undue delay, together with the mitigations you may need to take on your side.

Found something you think is a vulnerability? Please email us at support@whatslink.dev with the details — we appreciate responsible disclosure.

Data processing agreement

For customers who need one, Whatslink signs a Data Processing Agreement under Article 28 of the GDPR. Reach out to support@whatslink.dev and we will share the current version.

More information

Our Privacy Policy describes what data we collect and why. Our Terms cover the contractual side of using Whatslink.