In plain words: HTTPS, workspace isolation, access controls, and safe-sending limits — plus your team’s good habits.
1. Application security
- HTTPS/TLS for website and app
- Session protection and CSRF safeguards
- OTP / WhatsApp login options
- Validation on uploads including campaign and store images
2. Data & WhatsApp channels
- Customer workspaces are separated; we do not sell chat content
- Cloud API tokens must be kept secret and rotated if exposed
- QR-linked sessions should be treated like WhatsApp Web — protect the phone and review linked devices
- Use delays, daily caps, and opt-in to protect your number
3. Your responsibilities
Strong device locks, trusted teammates only, consented messaging, and lawful media only.
4. Report an issue
Email security@messageroots.com with reproduction steps. Please allow time for investigation before public disclosure.