Security and PII
When you connect your data or upload your files to our server, you are trusting us with
sensitive data. We take that responsibility seriously. From day one, security and
privacy have been part of our architecture decisions.
We want to share how we protect data in transit, at rest, and in use. Our goal is simple:
give you peace of mind that your customer conversations are safe.
Data in Transit
All traffic between our services and external clients is encrypted using TLS 1.2+.
- API calls to Robofy.ai are only accepted over HTTPS.
- Webhooks are validated with HMAC signatures so we can detect tampering.
- Internal service-to-service communication (Lambda → RDS, Lambda →
DynamoDB) also uses TLS, even though it happens inside a private VPC.
We don't allow plaintext connections, even for "internal" traffic.
Data at Rest
All sensitive data is encrypted at rest using AWS KMS keys.
- PII (e.g. customer phone numbers, WhatsApp IDs, message logs) is stored encrypted in
RDS and DynamoDB.
- Secrets (e.g. AI Keys, WhatsApp tokens, business IDs) are never stored in plaintext.
They are managed in AWS Secrets Manager.
- Backups on S3 are encrypted with bucket-level policies and customer-managed keys.
This ensures that even if someone accessed raw storage, they would not be able to read
sensitive content.
Token and Key Management
WhatsApp access tokens, business IDs, and phone IDs are the crown jewels. Our handling
approach:
- Stored only in AWS Secrets Manager, rotated automatically.
- Accessible only to specific Lambda functions with strict IAM policies.
- Never exposed to frontend or client-side code.
We treat tokens as ephemeral. If compromised, they can be revoked and rotated without
downtime.
Logging and Monitoring
We log enough to detect incidents, but never log sensitive content.
- CloudWatch captures system-level metrics and error rates.
- Application logs are scrubbed so that no phone numbers, tokens, or message bodies
are written.
- Audit logs exist for all admin actions: API key creation, role assignment, token
updates.
This balance lets us investigate issues without risking leaks.
GDPR, CCPA, and Regional Compliance
We are architected with compliance in mind:
- Data minimization: We only store what is needed for message delivery and analytics.
- Right to be forgotten: Customer data can be deleted permanently from RDS, DynamoDB,
and S3.
- Regional residency: For EU customers, we host in eu-west-1 (Ireland). For others, we
are expanding region-specific deployments.
- Audit readiness: Our design is aligned with SOC2 principles (security, availability,
confidentiality).
Data Residency in Europe
All customer data for EU accounts is stored and processed within AWS Europe (Ireland)
(eu-west-1). This ensures compliance with GDPR requirements around data residency and
prevents unnecessary cross-border data transfers. EU-based customers can be confident
that their WhatsApp message data never leaves the European region unless explicitly
configured by them.
Serverless by Design
We rely heavily on AWS serverless services such as Lambda, API Gateway, App Runner,
DynamoDB, and SQS. By choosing managed services instead of self-managed VMs or
containers, we reduce our surface area for vulnerabilities.
- No OS patching: AWS manages the underlying operating systems, so we never have to
worry about missing kernel updates or critical CVEs.
- No network maintenance: VPC networking, scaling, and load balancing are managed by
AWS.
- Automatic updates: Services like Lambda and App Runner are continuously updated by
AWS without downtime.
This approach lets our team focus on application-level security (encrypting PII, access
controls, token management) while AWS covers the infrastructure-level hardening.
Common Concerns We Hear
"If I connect my WhatsApp number, can your team read my messages?"
No. Messages are encrypted in transit from Meta, stored encrypted at rest, and never
exposed to support staff. We cannot casually browse message logs.
"What happens if one customer's account is compromised?"
Each organization has strict data isolation. Tokens and PII are scoped per account. A
breach in one account cannot access data from another.
"Do you support self-hosting?"
Yes. For enterprises, we support on-premise or dedicated VPC deployments. This ensures
compliance with industries that require full data control (e.g., healthcare, banking).
If you are a startup testing an idea, maybe you can live with weak security. But if you
are a mid-size or enterprise company attaching your customer conversations, you need
guarantees. That's where we differentiate.
We are opinionated about this: security should not be optional. It is core
infrastructure, not a feature.
Closing Thoughts
Attaching your WhatsApp number to a third-party platform is a sensitive decision. Our
approach ensures:
- Data is encrypted everywhere.
- Secrets are tightly controlled.
- Logs are clean but auditable.
- Compliance is built-in, not bolted on.
We want CTOs, architects, and developers to feel at ease choosing us. Because reliable
messaging is only valuable when it is also secure messaging.
