Security
Your customers trust you with their number. We take that seriously.
WhatsApp engagement means names, phone numbers, consent records and conversations. Buddy protects that data, your workspace, and the connection to your WhatsApp Business account.
Built on Meta's official WhatsApp Business Platform
Three layers of protection.
Your customer data, protected
Subscriber, consent, campaign and workspace data is encrypted in transit and at rest with our hosting and database providers.
Only the right people get in
Sign-in, workspace membership and roles mean only your team can manage your customer communication.
Meta Tech ProviderOfficial WhatsApp, never workarounds
Buddy runs on Meta's official WhatsApp Business Platform, never scraped numbers or unofficial automation.
Security is part of keeping the relationship healthy.
A customer who shares their WhatsApp number is trusting you with a direct line to them. Keeping that data safe, and messaging only with consent, is how that trust lasts.
How Buddy protects your data.
Security is built into how data is stored, accessed and sent.
Stored safely
Encrypted in transit and at rest with established hosting and database providers.
Accessed carefully
Roles and workspace membership control who can see and change what. API keys are scoped and revocable.
Sent responsibly
Every message goes through the official WhatsApp Business Platform, and only to people with an active opt-in.
The details.
Consent records for every subscriber.
When someone opted in, where, and what they agreed to, with STOP handled instantly. Privacy and messaging rules are built into how Buddy works.
Scoped, revocable API keys.
Each key belongs to one workspace and can be revoked any time.
Found a security issue? Tell us with enough detail to reproduce it and we'll investigate promptly.
Signed webhooks.
Every webhook is signed so your systems can verify it.
Trusted providers, listed.
The providers that host and run Buddy are on our Subprocessors page.
Workspace isolation.
Each workspace's data kept separate.
Data requests.
Export and deletion to support GDPR.
Is Buddy built on official WhatsApp infrastructure?
Yes. Buddy runs on Meta's official WhatsApp Business Platform, not scraped numbers or unofficial automation that puts accounts at risk.
Is my data encrypted?
Yes. Subscriber, consent, campaign and workspace data is encrypted in transit and at rest with our hosting and database providers.
Who can access my workspace?
Only people you invite, with the role you give them. API keys are scoped to one workspace and can be revoked at any time.
Where can I see your subprocessors?
Our Subprocessors page lists the providers that help us run Buddy and what each one does.
How do I report a vulnerability?
Contact us with enough detail to reproduce it. We'll investigate promptly and keep you updated.
Can customers ask for their data to be deleted?
Yes. You can export or delete a subscriber's data when they ask, to support privacy laws like GDPR.
Questions for your security review?
Tell us what your team needs and we'll answer directly.
