01/Security
How we protect your numbers and your data
Every line on this page is something the code does, with the value that proves it. Rows marked opt-in are off until you turn them on. We hold no security certification, and we don't claim one.
Your WhatsApp numbers
- exit
Each number connects through its own residential IP in its country. Proxy down? The number stays offline, never on a datacenter IP.
egress: residential or refuse - sticky
The exit stays put across restarts. It moves only after 3 failed connects, at most 4 times a day, or 8 if the number stays down.
sticky · rotate_after=3 · max 8/day - opt-in
Pacing, when you turn it on: typing first, then at most 12 a minute and 5 a minute to new contacts. Off by default.
messagesPerMinute 12 · firstContactPerMinute 5 - check
Before a first message to someone, we ask WhatsApp if the number is on it. If it isn't, nothing is sent.
message.failed · not_on_whatsapp - stop
A number WhatsApp logged out or banned is not reconnected in a loop, which tends to make it worse.
disconnectReason temporary_ban · logged_out - drops
Proxy drops reconnect on their own. Queued sends wait for the number and go out when it's back.
queued → ready → sent
Your data and your API
- signed
Every webhook is signed with HMAC-SHA256 over a timestamp and the body, so your endpoint can reject a forged or replayed request.
Wuapi-Signature: t=…,v1=… - retries
No 2xx from your endpoint? We retry, 6 attempts in all. Each event has an id to deduplicate on.
retries 30s · 2m · 10m · 1h · 6h - idempotent
Every POST takes an Idempotency-Key, so a retry after a timeout never sends twice.
Idempotency-Key · replayed 24h - scoped
Give each customer a project with its own keys. A project key can't see another project: those ids answer 404.
project key → one project · 404 not_found - at rest
API keys are stored as hashes. The session each number needs is stored encrypted.
sha256(key) · AES-GCM session snapshots - cards
Payments go through Stripe. Card data never touches wuapi.
Stripe Checkout · Stripe Tax
Access and accounts
- authz
Every call is checked against your organization, role and project before it reads or writes anything, and a test fails any function that skips it.
customer builders · publicSurface.test.ts - rate limit
Each API key gets 600 requests a minute. Over it, you get a 429 with Retry-After.
429 rate_limited · RateLimit-Remaining - rotate
Revoke an API key or rotate a webhook secret at any time, from the API or the dashboard.
POST webhook-endpoints/{id}/rotate-secret - outbound
Webhooks go only to public HTTPS URLs, never follow redirects, and time out after 10 seconds.
https only · redirect: manual · 10s - sign-in
Google and GitHub sign-ins need a verified email. Disposable inboxes can't sign up.
email_verified · one email, one user - staff
When our team opens your organization to help, it needs a stated reason and every change it makes is audited.
impersonation · reason required · audited
What we store
- Your account: email and a hash of your password, or your Google or GitHub identity.
- For each number: the phone number, its profile name, connection status and logs, and the session it needs to stay linked.
- Messages sent and received through the API, including media, so the API, the dashboard and webhook retries can return them.
- Webhook endpoints and a log of deliveries. API keys as hashes.
- Proxy traffic per number, for billing. Billing references from Stripe, never card data.
Deleting a connected account unlinks it from the phone. To delete your organization and its data, write to support.
Privacy policyWhat no setup can promise
wuapi links your number as a device, like WhatsApp Web, and is an independent service, not affiliated with WhatsApp. WhatsApp decides which numbers it restricts. A proxy removes a network signal; it does nothing about what you send or how people react to it, so consent is on you.
Keep your number healthyCheck it yourself
The status page checks the API, the engine and webhooks every minute. The docs show how to verify a signature, and the SLA says what paid support plans commit to.