Security and data handling
Linking a WhatsApp number to somebody else's server is a real decision. This page says exactly what that server keeps, where it runs, who can reach it and how long anything survives — in the same numbers the privacy policy commits to.
What we store
Message bodies are not archived. Wapito is a pipe: an inbound message is transformed into an event, delivered to your webhook, and the raw copy is dropped by the retention job days later. Nothing in the dashboard lets us browse your conversations, because the conversations are not there to browse.
- WhatsApp session credentials
- Until you delete the channel or log the number out
- Channel API tokens
- Until you rotate the token or delete the channel
- Message media (images, audio, documents)
- 24 hours on Sandbox, 7 days on Premium
- Raw inbound engine events
- 3 days
- Webhook jobs and delivery attempts
- 30 days
- API request log (method, route, status, duration, IP)
- 14 days
- Rate-limit counters
- 2 days
- Daily usage counters (sent, received, requests, checks)
- 90 days
- Account record (email, plan, channel list, billing state)
- Until you delete your account
- Payment records (amount, date, invoice id)
- As long as tax law requires, typically seven years
Where each of these lives and why it exists at all is spelled out, row by row, in the privacy policy — the same periods, as a commitment rather than a description.
Deleting a channel unlinks the WhatsApp session, drops its credentials and cancels its subscription. Deleting your account removes the account record and every channel on it; payment records survive only as long as tax law requires them to.
API tokens
A channel token is shown once, when the channel is created or the token is rotated. We store only its SHA-256 hash, in a private subcollection the browser cannot read even as the owner — so a copy of our database contains nothing that can call the API. Rotating a token invalidates the old one within seconds, and there is no endpoint anywhere that returns a token you already have.
Signed webhooks
Every delivery carries X-Wapito-Signature: t=<ms>,v1=<hex>, an HMAC-SHA256 of the timestamp and the raw request body under your own webhook secret. Verify it before you trust a payload, and reject anything whose timestamp is old — that is what stops somebody replaying a real event at your endpoint.
Where it runs
The API, the WhatsApp engine and Postgres run in Docker on a single Google Compute Engine virtual machine in us-central1, behind TLS terminated by Caddy. The engine is never exposed to the internet: it is reachable only from the API container on a private Docker network. Accounts, channel configuration and usage counters live in Firestore; static pages are served by Firebase Hosting. Backups of Postgres are taken nightly and restore is rehearsed rather than assumed.
Access and secrets
Secrets — Stripe keys, the media signing secret, engine credentials — are environment configuration on the VM and in Cloud Functions, never in the repository and never in the browser bundle. Firestore rules make channel documents readable only by their owner, and make every field that matters (status, plan, token preview) writable only by the API service. Administrative access is limited to the people who operate the service, and production access is used for incidents, not curiosity.
Outbound requests and hostile targets
A webhook URL is somebody else's server, and a webhook system is a request-forging engine if it is careless. Wapito accepts only HTTPS URLs that resolve to public addresses, re-checks the resolved address at send time, times a delivery out after ten seconds, stores at most a 512-character excerpt of the response, and opens a circuit breaker on an endpoint that keeps failing rather than hammering it.
Who else touches the data
Three processors, each with a narrow job: Google Cloud and Firebase, Stripe and Resend. What each one receives from Wapito, and nothing more, is listed in the privacy policy.
Nothing is sold, and no customer data is used to train anything. WhatsApp itself is of course in the path — it is their network — and Wapito is not affiliated with, endorsed by or certified by WhatsApp or Meta Platforms, Inc.
What we do not claim
Wapito has no SOC 2 report, no ISO 27001 certificate and no penetration-test letter to hand you. It runs on one virtual machine, which means a hardware failure is downtime rather than a transparent failover. If your compliance process needs any of those, it needs a different vendor today — and we would rather you found that out on this page than in month four.
Reporting a vulnerability
Email security@wapito.com with what you found and how to reproduce it. We aim to acknowledge within two business days and to tell you what we are doing about it within five. Please give us a reasonable window before publishing, do not access other people's data while testing, and do not run load or denial-of-service tests against the production host. There is no paid bug bounty yet; there is credit on the changelog and a fast, straight answer.