Security
Your customers' conversations are not our product
What we actually do to protect the data you put in Zhat Convex — and, just as importantly, what we do not yet claim.
Built to survive the security review.
Customer conversations are among the most sensitive data a business holds. We treat them that way.
Official WhatsApp Business API
Built on Meta’s Cloud API — never an unofficial bridge or a phone farm. Your number stays yours and can’t be banned for using us.
Credentials encrypted at rest
Access tokens are sealed with AES-256-GCM before they touch the database. Nothing sensitive is ever sent to the browser.
Every webhook verified
Inbound events are HMAC signature-checked against Meta’s app secret and rejected if they don’t match. Spoofed traffic never reaches your inbox.
Role-based access + audit log
Granular permissions per role, and an append-only record of who sent, edited, deleted or called — so you can answer “who did that?”.
Isolated per workspace
Every query is scoped to your account at the database layer. One tenant can never read another’s conversations, numbers or media.
Your data stays yours
Export it, or delete it and we delete it. No resale, no model training on your customer conversations. Ever.
Workspace isolation
Every workspace is a tenant, and every query is scoped to it. Tenant filtering is applied explicitly at each call site and enforced again underneath by a database-client extension that fails closed — if a query somehow reaches the database without a tenant scope, it errors rather than returning another customer's rows.
Credentials and webhooks
Your WhatsApp access tokens and CRM credentials are encrypted at rest, per workspace. Inbound webhooks — from Meta and from Bitrix24 — are signature-verified before they are trusted, so a forged request cannot inject a message or move a lead.
Access control and audit
Access is governed by six roles, from read-only up to workspace admin, and privileged actions are written to an audit log that records who did what and when. Support agents see conversations; they do not see billing.
What we do not claim
We are not SOC 2 or ISO 27001 certified, and we will not display a badge suggesting otherwise. If a compliance certification is a hard requirement for you, tell us — it is on the roadmap, and knowing it blocks a deal moves it up.
Reporting a vulnerability
Email hello@thecodegate.com with SECURITY in the subject. Tell us what you found and how to reproduce it. We will acknowledge it, fix it, and credit you if you would like to be credited. We do not threaten researchers who report in good faith.
Start sending media on WhatsApp today.
Connect your number in minutes. No code, no long contracts.