Security
Your customer data, and what we actually do with it.
RichAutomate holds your customers' phone numbers and conversations. That deserves a straight answer, not a badge wall. Below is every control we run, where your data sits, how we align to India's DPDP Act 2023 — and a plain list of the certifications we do not hold yet.
Controls in place
India data residency
Application servers and the primary database run in Bengaluru, Karnataka (India region). Message content, contacts and campaign data do not leave Indian infrastructure in normal operation. WhatsApp message delivery itself is handled by Meta under their own terms.
Tenant isolation
Every domain table carries a tenant identifier and every query is scoped to it at the application layer. One workspace cannot read another workspace’s conversations, contacts, templates or billing records. This boundary is treated as non-negotiable in code review.
Authentication
Dashboard sessions use Laravel Sanctum bearer tokens over HTTPS. The developer API uses separate per-workspace API keys with independent rate limits, so revoking an integration never affects dashboard logins.
Signed webhooks, both directions
Inbound Meta webhook subscriptions are gated by a shared verify token. Razorpay payment webhooks are verified with HMAC-SHA256 against the raw request body before any wallet write. Outbound webhooks we send you are signed with HMAC-SHA256 using your own secret, so you can verify they came from us.
Official Meta Cloud API only
We build exclusively on the official WhatsApp Cloud API (v24.0). No unofficial libraries, no browser-automation bridges, no reverse-engineered clients. That is why we will never promise you a ban-proof way to send unsolicited bulk messages — no such thing exists on the official API.
Audit trail
Account-level actions are recorded in an activity log tied to the acting user, which is what a DPDP data-principal request or an internal investigation actually needs.
DPDP Act 2023 alignment
Under the Digital Personal Data Protection Act 2023 you are the Data Fiduciary for your customers. RichAutomate acts as your Data Processor. These are the processor obligations we support today.
- Consent and opt-out
- Opt-outs are recorded against the contact and respected on subsequent campaign sends. Marketing sends require an opt-in basis you can evidence.
- Data export
- A workspace owner can request a full export of their contacts, conversations and campaign data. Requests go to [email protected] and are fulfilled from the live database.
- Data deletion
- Deletion of a workspace and its data on written request from the account owner. Billing records are retained where Indian tax law requires it.
- Purpose limitation
- We process your customer data to deliver the service you bought. We do not sell it, rent it, or use it to train models.
What we do not claim
Plenty of vendors imply certifications they do not hold. Ours, stated exactly:
- No SOC 2 Type II report. We have not completed a SOC 2 audit. If your procurement process requires one, say so before you buy — we will tell you honestly where we are rather than waste your evaluation cycle.
- No ISO 27001 certificate. Not certified.
- No published third-party penetration test. No external pen-test report exists to share yet.
- No ban-proof sending. Message quality and account standing are decided by Meta. Any vendor promising immunity from WhatsApp restrictions on bulk or unsolicited sends is selling you a risk they cannot control.
Found a vulnerability?
Report it to [email protected] with steps to reproduce. We acknowledge reports and will not pursue action against good-faith research that avoids privacy violations, data destruction and service disruption. Please do not test against other customers' workspaces.